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ABSTRACT 


This  volume  contains  the  formal  papers  presented  at  j 
a  Workshop  on  Rare  Event/Accident  Research  Methodology 
sponsored  by  the  Human  Factors  Section  o£  the  Center  for 
Consumer  Product  Technology,  National  Bureau  of  Standards 
held  at  NBS  May  26-28,   1976.     The  topics  addressed  at  the  , 
workshop  and  reflected  in  the  papers  in  this  volume  in- 
clude system  safety  engineering,  hypothesis  generation 
in  accident  research,  epidemiological  approaches  to  in- 
jury research,  observational  techniques  for  studying  com- 
plex tasks,  accident  simulation,  and  methodological  con-  | 
siderations  being  forced  by  the  law. 
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Introduction 


The  National  Bureau  of  Standards  (NBS)  has  long  been  involved  in 
research  and  standards  development  activities  in  the  areas  of  product 
performance  and  product  safety.    The  Bureau's  commitment  to  these 
activities  was  increased  when,  in  1974,  the  Institute  for  Applied  Technology 
established  the  Center  for  Consumer  Product  Technology  (CCPT) .    The  Center's 
mission  is: 

to  perform  research  and  development  toward  establishing 
and  advancing  measurement  techniques  and  test  methodology 
necessary  to  evaluate  safety  and  other  perfomance 
characteristics  of  consumer  products. 

In  support  of  this  mission,  the  Human  Factors  Section,  a  unit  of  the 
Product  Systems  Analysis  Division  within  CCPT,  sponsored  a  Workshop  on 
Rare  Event /Accident  Research  Methodology.    The  purpose  of  the  workshop 
was  twofold:     (1)  to  further  familiarize  Section  staff  with  a  variety  of 
methods  currently  being  applied  to  safety  problens,  thereby  improving  the 
Section's  capabilities;  and  (2)  to  provide  a  forum  for  the  exchange  of 
information  and  ideas  among  a  small  group  of  safety  practitioners  and 
accident  researchers. 

The  workshop  was  held  at  the  National  Bureau  of  Standards'  Gaithersburg , 
Nb-ryland  facility  May  26-28,  1976.    Eight  invited  participants  from  outside 
NBS  made  presentations  to  the  workshop  and  acted  as  discussants  in  sessions 
devoted  to  their  particular  specialities .    This  volume  includes  the  papers 
prepared  by  each  of  the  eight  presenters  which  served  as  the  basis  for 
their  presentations  to  the  workshop.    A  broad  range  of  topics  pertinent 
to  rare  event,  safety,  and  accident  research  were  presented.    The  topics 
addressed  at  the  workshop,  and  reflected  in  the  papers  here,  included 
systems  safety  engineering,  hypothesis  generation  in  accident  research, 
epidemiological  approaches  to  injury  research,  observational  techniques  for 
studying  complex  tasks,  accident  simulation,  and  methodological  considerations 
being  forced  by  the  law. 
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SYSTEM  SAFETY  ENGINEERING  AS  THE  INTEGRATOR 
OF  ACCIDENT  PREVENTION  ACTIVITIES 


Willie  Hammer 
Hughes  Aircraft  Company 

WILLIE  HAMMER  has  held  a  wide  variety 
o£  engineering  positions.    Since  1961  he 
has  been  involved  entirely  in  safety  engineering, 
with  the  Air  Force,  a  consulting  engineering 
firm,  and  now  Hughes  Aircraft  Company.  Mr. 
Hammer  has  taught  product  and  systems  safety 
courses  at  UCLA,  the  University  of  Wisconsin 
and  abroad.    In  addition  to  numerous  published 
articles  on  various  subjects,  mostly  safety. 
Hammer  has  written  the  highly  regarded  Handbook 
of  System  and  Product  Safety  (Prentice  Hall, 
1972) ,  and  Occupational  Safety  Management  Engineering 
(Prentice  Hall,  1975) . 

Hammer's  workshop  presentation  provides 
an  overview  of  the  discipline  of  System  Safety 
Engineering  and  a  brief  review  of  the  philosophy 
and  methods  of  System  Safety.    Central  to  his 
discussion  is  the  principle  that  accident  prevention 
activities  involving  any  product  or  system  must 
be  initiated  with  the  earliest  concept  of  that 
product  or  system  and  be  maintained  throughout 
its  life  cycle.    As  suggested  in  the  title  of 
his  paper.  Hammer  considers  this  discipline 
a  prime  candidate  for  the  task  of  integrating 
the  contributions  of  many  specialities  into 
a  comprehensive  program  of  accident  prevention. 
The  analytic  methods  of  System  Safety,  as  presented 
by  Hammer,  provide  a  logical  framework  for  applying 
the  results  of  research  and  experience  to  the 
very  real  safety  problems  faced  by  industry. 

Accident  prevention  is  an  activity  involving  many  considerations, 
managerial  activities,  and  technical  disciplines.    This  workshop  was  called 
because  of  this  and  to  familiarize  each  participant  with  the  areas  of 
interest,  methodologies,  and  capabilities  of  the  other  participants. 

I  am  a  system  safety  engineer.    For  those  of  you  who  are  not  familiar  with 
system  safety  engineering,  some  background  information  may  be  of  interest. 

After  World  War  II,  personnel  concerned  with  prevention  of  aircraft 
accidents  began  to  express  their  view  that  safety  must  be  designed  into 
airplanes  like  any  other  required  characteristic.    Some  aircraft  companies 
formed  safety  organizations  to  this  end,  but  it  was  not  a  concerted  effort 
throughout  industry. 
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The  concerted  effort  began  in  the  early  1960 's  because  of  Air  Force 
concern  for  safety  with  highly  lethal  intercontinental  ballistic  missiles. 
The  missiles  were  capable  of  causing  horrendous  injury  and  damage.    If  one 
was  lost  catastrophically  no  blame  could  be  put  on  a  pilot,  as  in  an  aircraft 
accident,  since  there  was  none  on  board  a  missile.    In  addition.  Air  Force 
operating  units  were  being  given  vehicles  powered  by  exotic  fuels  and  oxidizers 
with  highly  dangerous  characteristics.    The  philosophy  developed  that  safety 
programs  had  to  be  initiated  almost  as  soon  as  the  new  system  was  conceived, 
and  carried  on  through  all  phases  of  development,  production,  and  operation. 

To  mitigate  seme  of  these  problems  requirements  were  written  into 
contracts  which  required  safety  efforts  to  be  undertaken  during  development  of 
missiles.    These  requirements  were  generally  limited  to  those  contracts 
for  which  there  was  serious  concern  for  safety,  and  for  which  someone  in 
authority  was  knowledgeable  and  forceful  enough  to  have  them  imposed.  In 
1962  work  was  initiated  on  an  Air  Force  specification  which  would  require 
all  missile  contractors  to  undertake  system  safety  programs.    This  was  soon 
extended  to  aircraft  and  other  Air  Force  equipment.    The  concept  was  soon 
caught  up  by  the  Army  (especially  for  helicopters)  and  the  Navy  so  that  the 
Department  of  Defense  issued  directives  requiring  system  safety  programs  be 
undertaken  for  systems  to  be  developed  or  modified.    Six  years  ago,  perhaps 
one  of  ten  contracts  for  military  systems  had  requirements  for  a  system  safety 
program;  now  the  rate  is  about  eight  of  ten. 

System  safety  programs  were  being  called  for  but  there  was  a  lack  of 
methodologies  for  accident  prevention  which  could  be  used  for  complex  systems. 
There  is  no  school,  technical  society,  or  other  large  organization  at 
which  research  in  system  safety  engineering  is  being  conducted.  Therefore, 
we  who  work  in  this  discipline  must  sometimes  do  our  own  research  in  order  to 
meet  the  requirements  of  our  jobs.    We  have  adopted,  adapted,  and  developed 
methods.    We  have  been  forced  by  necessity  into  an  organized  approach  to 
accident  prevention  by: 

.    Evolving  new  concepts  and  methodologies. 

.    Refining  old  concepts  and  methodologies . 

.    Adapting  techniques  from  other  scientific,  technical,  and 
management  disciplines  to  our  needs . 

.    Eliminating  erroneous,  invalid,  or  unnecessary  data, 
concepts ,  requirements ,  methods ,  or  equipment . 

Integrating  related  management  and  technical 
activities . 

Programmed,  systematic  determination  of  hazards  and 
their  elimination  or  control. 

To  accomplish  our  jobs  we  had  to  know  something  about  program  management, 
and  about  the  activities  of  other  engineering  disciplines,  their  objectives, 
techniques,  and  capabilities.    There  are  many  disciplines  whose  practitioners 
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were  (and  are)  concerned  with  safety  and  accident  prevention  but  who  were  almost 
always  also  interested  in  additional  considerations.    System  Safety  and  reli- 
ability engineers  share  a  concern  regarding  malfunctions  which  could  lead 
to  accidents.    If  a  malfunction  cannot  cause  an  accident,  we  safety  engineers 
are  not  concerned.    Reliability  engineers  are  interested  in  any  malfunctions 
and  in  quality  control  of  all  operable  items.    Maintainability  engineers 
are  interested  in  malfunctions  which  require  repair;  they  are  also  concerned 
with  logistic  support  of  a  system  or  product.    System  Safety  engineers  are 
concerned  with  maintainability  engineering  for  two  reasons :    the  lack  or 
inadequacy  of  which  could  result  in  accidents  to  operators,  and  in  designs 
which  could  cause  injury  to  maintenance  personnel. 

We  in  System  Safety  engineering  believe  that  a  hazardous  condition  must 
exist  in  order  to  have  an  accident.    These  hazardous  conditions  can  be  due  to 
personnel  errors,  mechanical  failures,  dangerous  characteristics  of 
equipment  or  material ,  and/ or  adverse  environmental  factors .    There  are 
numerous  instances  in  which  these  overlap.    For  example,  hazardous 
characteristics  of  equipment  or  material  are  either  inherent  or  created  by 
design  error,  one  of  the  subcategories  of  personnel  error.    I  have  put  the 
four  categories  and  their  interrelationships  into  a  mathematical 
expression  (Exhibit  1)  to  indicate  simply  the  various  factors  involved. 

Some  of  the  engineering  disciplines,  besides  System  Safety,  which  might 
be  interested  in  the  four  rough  categories  would  include,  but  not  be  limited 
to: 

.    Personnel  errors:    human  factors  engineers,  psychologists, 
design  engineers,  and  procedures  and  manual  writers. 

.    Mechanical  failures:    design  engineerings,  reliability  engineers, 
metallurgists,  quality  control  engineers; 

.    Hazardous  equipment  or  material:    design  engineerings,  chemists 
and  chanical  engineers,  materials  engineers,  industrial  hygienists, 
biochemists ; 

.    Environmental  factors :    design  engineers ,  meteorologists ,  industrial 
hygienists,  structural  engineers,  sound  engineers. 

Note  the  fact  that  design  engineers  are  cited  in  each  case.  An 
objective  study  would  undoubtedly  reveal  that  many  injuries  and  much  damage 
could  have  been,  and  can  be,  avoided  by  better  designed  equipment.  Safe- 
guards against  accidents  should  be  designed  into  equipment  as  much  as 
possible,  and  little  reliance  placed  on  procedures  to  be  followed  by  users. 
I  said  there  is  no  school  at  which  research  in  system  safety  engineering  is 
being  conducted.    The  situation  is  only  slightly  better  when  it  comes  to 
teaching  system  safety  engineering  to  undergraduate  engineers .    The  courses  in 
existence  teach  safety  engineering  to  students  aiming  to  be  safety  engineers, 
but  unless  they  have  been  instituted  very  recently,  I  don't  believe  there  is  a 
school  which  teaches  safety  to  engineers  who  will  go  into  other  fields, 
especially  design.    Yet,  these  are  the  ones  who  will  be  designing  the  equipment 
which  turns  out  to  be  unsafe. 


What  have  we  System  Safety  engineers  done  so  far  which  could  be  considered 
noteworthy? 

.    This  discipline  is  predicated  on  the  principle  that 
accident  prevention  activities  involving  a  system  or  product  must  begin  with 
the  initial  concept  of  that  system  or  product  and  be  maintained  throughout 
its  life  cycle.    Tasks  have  been  developed  to  be  carried  out  during  each  phase 
of  the  life  cycle.    The  erroneous  idea  that  safety  engineering  during 
development  before  a  product  is  unnecessary  before  it  is  built  and  tested 
must  be  eradicated.    A  list  of  safety  tasks,  the  outputs  and  potential 
problems  in  carrying  out  a  product  safety  program  are  presented  in  Exhibit  2. 

.    One  of  the  first  and  most  important  tasks  listed  in 
Exhibit  2  is  the  preparation  of  safe  design  criteria  to  be  observed  by 
designers.    Good  standards  for  safe  design  must  be  provided  as  soon  as  the 
system  or  product  is  conceived.    There  must  be  means  for  ensuring  that  the 
standards  are  observed.    But  even  with  the  best  standards,  hazards  can  still 
exist  in  a  product.    There  must  therefore  be  means  for  analyzing  the 
system  or  product  to  make  certain  that  these  potential  hazards  have  been 
eliminated  or  controlled. 

Safety  criteria  in  most  product  standards  are  generally 
lacking,  inadequate,  or  ineffective.    The  A. N.S.I,  standards  for  products 
are  not  only  wanting  in  respect  to  safety,  but  because  they  are  voluntary 
are  often  ignored.    Admiral  Hyman  Rickover's  comments  regarding  standards  are 
noteworthy: 

"To  forestall  intrusion  of  Government,  the  industry  concerned 
will  usually  propose  voluntary  safety  requirements .    These  requirements 
represent  the  minimum  all  are  willing  to  accept.    This  is  not  enough.  There 
are  more  accidents .    Only  after  the  lapse  of  much  time  are  laws  finally 
enacted.    Mach  harm  will  have  been  done  in  the  interval --harm  which  could 
have  been  prevented. 

The  typical  industry- controlled  code  or  standard  is  formulated 
by  a  committee  elected  or  appointed  by  a  technical  society  or  similar 
group.    Many  of  the  committee  monbers  are  drawn  from  the  manufacturers  to 
whom  the  code  is  to  be  applied.    Others  are  drawn  from  engineering  consulting 
firms  and  various  Government  organizations.    However,  since  near  unanimous 
agreement  in  the  committee  must  generally  be  obtained  to  set  requirenents  or  to 
change  them,  the  code  represents  a  minimum  level  of  requirements  that  is 
acceptable  to  industry. 

In  a  subtle  way,  the  use  of  industry  codes  or  standards  tends  to 
create  a  false  sense  of  security.    Described  by  code  committees  and  by 
the  language  of  many  of  the  codes  themselves  as  safety  rules ,  they  tend 
to  inhibit  those  legally  responsible  for  protecting  the  public  from  taking 
the  necessary  action  to  safeguard  health  and  well-being.    Nfeny  States 
and  municipalities  have  incorporated  these  codes  into  their  laws,  thus, 
in  effect  delegating  to  code  committees  their  own  responsibility  for  protecting 
the  public." 
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If  we  conpare  safe  criteria  stipulated  in  industry  standards  with 
those  in  government -prepared  documents,  such  ^s  in  military  specifications 
and  standards ,  we  find  the  government  criteria  more  stringent  for  the 
same  hazards.    In  addition,  they  are  wider  in  scope.    Yet  these  military 
requirements  are  for  personnel  whose  mental  and  performance  capabilities 
and  training  are  far  higher  than  the  general  public  who  are  to  be  protected 
by  industry  standards.    If  the  Consumer  Product  Safety  Commission  has 
industry  develop  its  own  standards,  as  it  has  been  attenpting  to  do, 
it  will  recreate  the  same  unhappy  situation  Admiral  Rickover  has  described. 

One  possible  solution  is  the  use  of  a  new  system  which  at  Hughes 
Aircraft  Company  have  recently  developed  and  are  still  refining.  We 
call  it  SCRAT,  for  Safety  Criteria  Retrieving  and  Tabulating.    It  is 
predicated  on  the  idea  that  any  system,  product,  subassembly,  or  material 
can  have  only  certain  hazards  and  that  the  safe  design  criteria  for  these 
hazards  can  be  prepared  to  apply  in  general  terms  to  all  items  which 
have  potential  hazards.    We  have,  therefore,  put  safe  design  criteria 
for  our  products  into  a  computer.    When  we  want  the  criteria  for  any 
item,  we  can  retrieve  them  at  will  for  the  specific  design  being  undertaken. 
A  safety  engineer  then  reviews  it  and  adds  any  other  safe  requirements 
that  may  have  been  stipulated  for  observance  in  a  contract.    We  are  still 
refining  the  system  but  even  the  early  usages  we  have  been  beneficial. 

The  process  could  be  expanded  for  use  by  the  Consumer  Product  Safety 
Commission  to  satisfy  most  of  its  needs  for  developing  product  safety 
standards .    (The  criteria  we  use  are  for  the  products  we  produce  and 
limited  in  scope.    In  addition,  our  criteria  are  derived  from  military 
specifications  and  standards.)    The  computer  readout  can  also  be  used  i 
by  C.P.S.  engineers  as  checklists  to  evaluate  whether  a  product  appears 
to  be  safe. 

There  are  numerous  other  uses  to  which  SCRAT  can  be  put.    If  any 
of  you  are  interested  and  want  further  information,  please  let  me  know. 

The  "Fly-Fix-Fly"  methodology  of  determining  potential  hazards 
which  might  exist  in  a  product  only  by  reviewing  the  causes  of  ' 
accidents  or  presentations  in  lawsuits  cannot  be  justified  logically, 
economically,  operationally,  or  morally.    To  determine  and  control  the 
potential  hazards  which  could  exist  in  a  system,  product  or  operation, 
new  methods  of  analysis  have  been  developed.    The  best  of  these.  Fault 
Tree  Analysis,  was  originated  by  Bell  Telephone  Laboratories  under  an  i 
Air  Force  contract.    The  Air  Force  was  much  concerned  that  the  Minuteman 
ICBM  could  be  launched  or  the  nuclear  warhead  detonated  either  inadvertently 
or  by  an  unstable  person.    A  means  for  assessing  the  possibilities  qualitatively 
and  quantitatively  were  wanted.    The  techniques  of  reliability  analysis 
were  inadequate  for  the  purpose:    the  effects  of  multiple  failures  were 
not  considered;  personnel  error  and  other  actions  were  not  considered; 
possibilities  of  single  point  failures  could  not  be  established. 

For  those  who  are  not  familiar  with  Fault  Tree  Analysis,  a  very 
brief  description  may  be  in  order.    A  specific  adverse  event  or  condition 
to  be  investigated  is  selected.    All  the  factors  which  can  contribute 
directly  to  this  event  or  condition  are  then  shown  on  a  logic  diagram.    The  causes 
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of  these  secondary  factors  are  then  added,  developing  downward  like  the 
roots  (although  they  are  called  branches)  of  a  tree.    Following  the  tree 
downward  indicates  the  causes  of  an  event;  following  it  upward  indicates 
the  effects. 

The  Fault  Tree  can  be  used  for  qualitative  purposes  to  indicate 
diagrammatical ly  the  cause  and  effect  relationships ,  or  it  can  be  prepared 
so  that  probabilities  of  the  top,  specific  adverse  event  can  be  calculated. 
By  means  of  Boolean  algebra,  mathematical  equations  can  be  written  and 
sinplified  which  will  express  the  top  event  in  terms  of  the  basic  causative 
factors.    Simplification  of  the  equation  will  eliminate  redundancies. 
In  addition  to  providing  an  expression  for  the  top  event,  the  simplification 
will  indicate  where  potential  single  point  failures  exist.  Probabilities 
of  occurrence  of  the  basic  causative  factors  can  be  inserted  in  the  equation 
and  the  probability  of  the  top  adverse  event  calculated. 

Because  it  was  the  prime  contractor  for  the  Minuteman  system,  the 
Boeing  Company  became  the  first  major  user  and  proponent  of  Fault  Tree 
Analysis.    Bell  Telephone  Laboratories  personnel  had  indicated  symbology 
to  be  used;  Boeing  personnel  added  to  it.    (Symbols  generally  used  are 
indicated  in  Exhibit  3;  a  simple  Fault  Tree  in  Exhibit  4.)    There  are 
many  variations  in  symbology,  generally  to  simplify  usage.    Notation  are 
used  to  permit  computer  calculation  and  preparation  of  fault  tree  diagrams 
for  complex  systems . 

The  method  is  being  used  for  purposes  other  than  safety.  Reliability 
engineers  are  using  it.    The  top  event  selected  is  one  indicating  that 
successful  accomplishment  of  an  event  (only  material  failures  are  included) . 
The  probability  of  successful  accomplishment  is,  by  definition,  reliability. 

Other  applications  of  Fault  Tree  Analysis  have  been  in  accident  investi- 
gation, where  the  top  event  is  the  injury  or  damage  which  occurred.  IVbnagement 
Oversight  and  Risk  Tree  (NDRT) ,  developed  by  Aerojet  Nuclear  Company, 
endeavors  to  establish  logically  the  contributory  management  events  which 
could  or  fail  to  produce  a  specific  management  objective. 

Fault  Tree  Analysis  is  an  excellent  method  but  is  not  usable  for 
all  accident  prevention  analyses.    Its  basic  premise  is  analysis  of  a 
specific  event.    Factors  which  do  not  contribute  to  that  event  are  not 
included  in  that  tree.    If  they  are  to  be  considered,  another  tree  with 
a  suitable  top  event  must  be  developed.    The  lower  levels  of  the  tree 
frequently  cannot  be  developed  until  after  the  product  is  designed.  System 
Safety  engineers,  therefore,  use  other  types  of  analysis,  from  simple 
analytical  reports  to  more  complex  mathematical  studies.    For  example, 
at  the  beginning  of  a  development  program  a  Preliminary  Hazard  Analysis 
if  usually  prepared  which  provides  an  initial  assessment  of  hazard  which 
would  be  present  in  a  new  product  or  operation  as  proposed.  Corrective 
action  could  be  taken  immediately. 
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.    Another  area  in  which  we  have  been  working  is  in  quantitative 
measures  of  safety.    I  pointed  out  that  the  inadequacy  of  reliability 
methodologies  to  this  end  was  a  compelling  reason  the  Air  Force  went  to 
Bell  Telephone  Laboratories,  leading  to  the  development  of  Fault  Tree 
Analysis.    There  are  other  reasons  for  interest  in  quantitative  measures: 

+    Risk  assessment.    Many  companies  would  like  to  know  the  risk  which 
use  of  certain  equipment  or  conduct  of  certain  operations  would  entail. 
Decisions  can  be  made  based  on  economic  justifications  determined  this 
way.    Insurance  companies  are  interested.    To  determine  potential  losses 
it  is  necessary  the  probability  of  an  accident  or  accidents  be  known. 
It  is  frequently  undesirable,  especially  with  new  products,  to  obtain 
probability  values  from  accident  statistics . 

+    Establishment  of  acceptable  safety  levels.    A  regulatory  agency, 
such  as  the  Consumer  Product  Safety  Commission,  can  require  that  products 
meet  stipulated  safety  levels  before  they  can  be  put  on  the  market.  The 
British  Civil  Aviation  Authority  is  already  doing  this  with  aircraft  to 
be  certified  for  flights  into  the  British  Commonwealth. 

+    Comparisons.    Quantitative  levels  can  be  used  to  compare  two  or 
more  designs  to  see  which  is  safer.    Safety  analysts  in  nuclear  power 
design  activities  have  done  this. 

We  have  been  running  into  problens  in  this  area.    Some  of  the  solutions 
will  depend  on  activities  in  other  disciplines.    For  example,  we  need 
good,  valid  data  on  probabilities  of  human  error.    There  have  been  abuses 
in  the  use  of  quantitative  goals ,  but  little  by  little  the  problems  are 
being  eliminated. 

The  philosophies  of  System  Safety,  the  concept  of  life-cycle  program 
planning,  and  the  techniques  of  SCRAT  and  of  hazard  analysis  can  be  applied 
universally  in  accident  prevention.    A  good  System  Safety  engineer  will 
be  knowledgeable  in  all  of  these.    He  may  not  be  as  well  qualified  in 
highly  specialized  disciplines  from  which  it  is  necessary  to  obtain  esoteric 
information.    Where  data  on  probabilities  of  human  error  are  required 
he  must  step  aside  for  the  ]iuman  factors  engineer  or  the  psychologist. 
On  the  other  hand.  System  Safety  methodologies  can  be  used  to  determine 
how  the  efforts  of  specialists  can  best  be  utilized  in  an  effective  course 
of  action.    System  Safety  engineering  methodologies  can  be  used  to  integrate 
accident  prevention  programs . 

That,  to  a  limited  extent,  is  what  we  System  Safety  engineers  do. 
I  hope  that  one  of  the  outcomes  of  this  Workshop  will  be  a  recommendation 
for  accident  prevention  research  programs  over  a  long  term.    I  hope  that 
we  System  Safety  engineers  are  invited  to  participate  in  the  development 
of  the  programs  and  in  specific  research  activities.    We  have  the  people, 
the  methodologies,  the  capabilities,  and  the  experience. 
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INVESTIGATIVE  METHODS  USEFUL  IN  SAFETY 


William  G.  Johnson 
Energy  Research  and  Development  Administration 

This  paper  was  prepared  by  WILLIAM  G.  JOHNSON 
and  discussed  at  the  workshop  by  ROBERT  EICHER. 
Mr.  Eicher  has  worked  closely  with  Johnson  at 
the  Energy  Research  and  Development  Administration 
(ERDA)  (formerly  AEG)  where  he  is  Special  Hazards 
Engineer  in  the  Division  of  Safety,  Standards, 
and  Compliance.    Mr.  Johnson,  retired  general 
manager  of  the  National  Safety  Council,  is  the 
author  of  M3RT  -  The  ^fanagement  Oversight  and 
Risk  Tree,  which  he  prepared  for  the  U.S.  Atomic 
Energy  Commission,  Division  of  Occupational 
Safety. 

MORT  is  a  major  output  of  ERDA's  continuing 
development  of  a  safety  management  methodology 
for  reducing  accident  rates.    Application  of 
M3RT  has  been  primarily  in  occupational  safety, 
however,  many  of  the  techniques  and  methods 
employed  can  be  useful  in  consumer  product  technology 
as  well.    The  paper  presented  here  serves,  in 
large  part,  to  introduce  and  annotate  MORT  for 
the  workshop  participants. 

For  the  past  six  years  ERDA  (formerly  AEG)  has  been  developing  a 
safety  management  methodology  to  augment  its  basic  physical  research  goals. 
AEC  had  had  safety  programs  and  records  equal  to  the  best  practices  of 
private  industry  and  government.    Nevertheless,  the  goal  of  the  development 
work  was  stated  as  "an  order  of  magnitude  reduction  in  rates  and  risks." 

The  investigative  method  used  in  the  developing  "superlative  safety 
assurance  systems"  for  ERDA  was  as  follows: 

1.  Conceptual  framework  --  development  of  a  trial  synthesis 

from  the  best  organizational  practices,  aerospace  system  safety 
methods,  safety  related  research,  and  behavioral,  organizational 
and  managerial  sciences; 

2.  Further  development  from  analysis  or  reinvestigation  of  accidents; 

3.  Trial  in  an  organization  (Aerojet  Nuclear),  and  then  restatonent 
of  the  synthesis ; 

4.  Application,  training,  and  technical  assistance  agency-wide; 

5.  Ongoing  development,  especially  at  Aerojet,  but  also  as  numerous 
laboratories  and  production  facilities . 
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The  primary  outputs  have  been  two: 


^ORT  -  The  Management  Oversight  and  Risk  Tree,  U.  S.  Atomic  Energy 
Commission,  February  12,  1973,  SAN  821-2. 

Accident/Incident  Investigation,  Energy  Research  and  Development 
Administration,  August  1,  1975,  ERDA-76-20. 

In  progress  is  Workbook  on  Measurement  of  Safety  Assurance  Programs.  A 
review  draft  is  scheduled  for  May  and  a  pilot  training  draft  for  the  Fall, 
1976.    The  Workbook  will  offer  numerous  examples  of  the  measurement  data 
believed  needed,  augmenting  the  hundreds  of  specific  questions  already 
posed  in  NDRT.    A  method  cumulating  many  specific  measuronents  into 
assessment  of  eight  broad  system  criteria  will  be  proposed. 

A  growing  number  of  supportive  publications  are  coming  from  System 
Safety  Development  Center  at  Aerojet: 

Occupancy-Use  Readiness  Manual, 
Human  Factors  in  Design, 

A  Contractor  Guide  to  Advance  Preparation  for  Accident  Investigation, 
MDRT  User's  Manual  (to  be  published  shortly). 

In  addition  a  variety  of  training  aids  and  experimental  forms  are 
of  interest  as  to  methodology. 

Organizational  research  in  safety  has  the  following  obstacles: 

1.  The  rarity  of  major  events, 

2.  Difficulty  of  cross-context  comparisons  of  complex  organizations, 

3.  Paucity  of  basic  research  or  relevant  data, 

4.  Lack  of  research  orientation  among  safety  practitioners. 

The  synthesis  has  supplied  a  conceptual  framework  wherein  investigation 
becomes  more  searching  and  testing  of  control  programs  is  more  nearly 
possible. 

In  the  course  of  the  six -year  project  a  wide  variety  of  research  and 
investigation  methods  have  been  assimilated,  and  some  new  methods  have 
been  developed. 

The  three  years  subsequent  to  publication  of  MORT  have  included 
widespread  examination  and  use  of  the  systems  by  managers  and  scientists 
of  many  disciplines.    The  usage  has  confirmed  the  basic  1973  report,  and 
resulted  in  extension  and  development  rather  than  drastic  change. 

A   A  ^: 
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The  relevance  o£  the  "superlative  safety  systems"  for  consumer 
product  technology  lies  in  two  areas: 

1.  Product  safety  up  to  the  point  of  consumer  use  is  amenable  to 
the  same  control  processes  (given  the  substitution  of  appropriate 
use  and  user  data,  consumer  rather  than  employee) ; 

2.  Some  elements  of  the  system  may  have  relevance  or  usefulness  in  the 
consumer  use  phase,  but  because  of  the  obvious  differences  between 
controllable  employee  behavior  and  typical  consumer  behavior,  the 
use  phase  requires  separate  evaluation  of  any  given  study  method  for 
a  control  or  technique. 

*  *  * 

For  the  convenience  of  Workshop  participants,  a  reprint  on  WRT  from 
the  Journal  of  Safety  Research,  March  1975,  is  attached  as  Appendix  A. 
Also,  ERDA  has  made  available  copies  of  the  above  publications  to  Workshop 
participants . 

This  paper  could  be  called  a  "Smorgasbord  of  Investigative  Methods." 
The  intent  is  to  call  out  the  developments  within  the  project  briefly.  Then, 
if  the  reader  is  interested,  the  texts  or  references  can  be  consulted.  Many 
specific  measurements  and  experiments  are  described  in  the  text. 

The  order  of  listing,  with  a  few  exceptions,  follows  the  order  of  the 
MDRT  text. 

I.  Introduction.    Among  other  concepts,  the  significance  of  codes, 
standards ,  and  regulations  is  presented.    They  are  minima.    Useful  and 
necessary  to  put  a  floor  under  performance,  but  not  the  route  to  the 
optimum  performance  desired  by  all. 

II .  What  Procedures  Hazards 

1.  Accident/ Incident  definition.    An  essentially  new  definition  is 
presented  (p.  25) .    It  was  developed  for  functional  use  in  design 
of  safety  measures.     (Short  definitions  may  be  superior  for 
tabulating  events,  but  do  not  lead  into  essential  preventive 
aspects.)    Also  Hazard  and  Risk  are  defined. 

2.  Energy  and  Barriers.    The  Gibson-Haddon  concepts  are  simple  and 
objective,  and  have  many  advantages  for  prevention  analysis. 
Systematic,  sequential  analysis  of  possible  barriers  has  repeatedly 
produced  innovative  safety  devices  of  superior  efficacy. 

3.  Frequency- Severity  Matrices.    Different  accident  sources  typically 
have  different  slop  lines .    A  slop  less  than  the  45°  line  of 
balance  is  a  danger  sign,  and  appears  to  have  catastrophe  pre- 
diction value. 
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4.  Error  as  Accident  Cause.    The  substantial  literature  on  error 
measurement  and  error  reduction  methods  can  be  brought  to  bear 
on  safety. 

a.  Rigby's  "error  tolerance  limits"  (p.  52)  useful  in  studying 
degrees  of  control ,  provide  macabre  humor  when  a  limit  turns 
out  to  be  "forensic." 

b.  The  Surry  decision  model  (p.  54)  has  been  under  careful 
observation.    While  it  seems  conceptually  correct,  its 
practical  significance  seems  limited  under  circumstances 
of  typically  subtle  danger  buildup  often  conditioned  by 
changes  remote  in  time,  and  the  blinding  speeds  of 
accident  occurrence.    If  non- injury  errors  or  unreviewed 
changes  were  seen  as  danger  signals,  the  Surry  scheme  could 
be  useful.     (See  McKie,  p.  61,  for  a  natural  history  note.) 

c.  The  extensive  reliability  and  error  prevention  work  of  ERDA's 
weapon  production  program  is  essentially  product  safety.  Mich 
in  the  way  of  useful  concepts  and  data  on  error -provocative 
situations  has  emerged.    A  key  point  in  the  work  of  Sandia 
Lab  is  the  need  for  error  rates  of  the  general  form:  errors/ 
opportunities,  i.e.,  the  need  for  user  data  as  well  as  accident 
data. 

5.  The  Role  of  Change  in  Accidents.    This  is  one  of  the  most  important 
MORT  developments.    The  basic  concept  of  Kepner-Tregoe--in  a 
stable  system,  change  is  the  cause  of  the  trouble--was  initially 
studied  by  NSC  and  has  been  under  intensive  study  by  ERDA.  Change 
analysis  is  a  most  powerful  technique  for  identifying  obscure 
causes.    It  is  particularly  useful  in  product  quality  assurance. 

(The  form  on  page  67  is  not  a  form  to  be  filled  out.    The  left  hand  tabs 
are  intended  only  to  be  indicative  of  the  event-related  factors  to  be 
inserted.) 

Most  (perhaps  all)  serious  accidents  have  one  or  more  changes,  usually 
detectable. 

Equally  powerful  as  a  preventive  medium  is  "Change  Based  Potential 
Problem  Analysis."    (The  form  on  page  69,  as  now  used,  has  a  column  "Effects 
of  Change"  inserted  before  "Preventive  Counter -Change.") 

This  analysis  could  be  significant  in  design  of  a  revised  model  of 
a  product.    Call  out  all  differences  (e.g.,  as  irrelevant  as  color),  then 
analyze  Effects  of  Change.    It  often  turns  out  that  so-called  irrelevant 
changes  have  significance.    This  inexpensive,  perceptive  form  of  analysis 
should  be  a  requirement  on  every  project  and  for  every  significant  change. 

The  effects  of  changes  are  directional  and  exponential- -quite  a 
challenge! 
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6.  Sequences  in  Accident  Causation.    MDRT  (1973)  is  essentially  just 
descriptive  of  a  phenomenon  of  lengthy  sequences . 

The  use  of  sequence  as  an  analytic  device  was  developed  by 
Benner  and  Wakeland  for  NTSB.    Following  their  leadership  the  ERDA 
Accident/Incident  Investigation  Manual  (AIM),  pages  4-3  to  4-8,  and 
Appendix  I,  discuss  the  method,  "Events  and  Causal  Factors  Sequence 
Diagram,"  and  show  illustrative  cases.    The  sequence  diagram  is 
the  usual  focal  point  of  analysis. 

Sequence  diagrams,  coded  by  MDRT  codes,  now  seem  a  realistic 
possibility  for  causal  information  coding  and  retrieval. 

7.  The  Role  of  Risk  Management.    The  scientific  literature  is  summarized, 
but  provides  little  practical  material.    The  concept  which  associates 
risk  with  the  profitable,  creative,  and  "fun"  side  of  a  line  of 
balance  is  articulated.    The  simplest  useful  model  of  risk 
assessment  is  described. 

Ill .    How  to  Reduce  Hazards 

8 .  Integrating  System  Safety  with  Present  Best  Practices.  System 
safety,  as  developed  in  aerospace  and  nuclear  industries ,  is 
project  related.    Insofar  as  product  safety  is  a  project  by 
project  effort,  system  safety  can  be  a  recommended  approach.  The 
text  provided  by  Willie  Hammer*  (a  Workshop  participant)  is  a 
valuable  guide. 

The  need  to  integrate  system  safety  with  the  best  organizational 
practices  arises  from  the  ongoing,  continuous  operation  of  the 
organization,  not  usually  seen  as  merely  as  series  of  projects. 

The  MDRT  synthesis  incorporates  system  safety  with  numerous 
references  (Hammer's  text  was  not  then  available).  However, 
by  now  MDRT  also  incorporates  many  methods  and  criteria  not 
customarily  found  in  system  safety,  e.g.,  change  analysis, 
independent  review,  procedure  criteria,  the  full  spectrum  of 
human  factors  concerns,  ongoing  monitoring  and  audit  systems, 
and  the  basic  management  policy  and  implementation  factor. 

The  basic  position  is  that  MDRT  and  project  system  safety 
are  noncompetitive.    Start  with  whichever  one  seems  appropriate 
for  an  ongoing  organization  or  a  project  and  then  add  the  other. 

9.  Method  vs  Content.    Analytic  or  observational  method  (with  good 
people)  ?ias  repeatedly  shown  that  it  is  Fast  and  Cheap ,  and  that 
it  can  find  some  deficiencies  not  usually  revealed  by  hardware, 
technical  or  process  specialists.    Examples  again  are  error, 
change,  and  sequence  analysis. 


*Hammer,  Willie,  Handbook  of  System  and  Product  Safety,  Prentice  Hall,  1972. 
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10.  Safety,  Efficiency  and  Performance  are  Congruous.    This  tenet 
can  be  illustrated  with  anecdotes  and  strong  beliefs  in  some 
business  circles.    It  is  not  scientifically  proven.  This 
carries  over  to  consumer  products  which  commonly  have  energy 
use  or  conservation  methods  of  performing  work. 

If  organizational  safety  program  is  redefined  as  those 
elements  likely  to  improve  safety  and  performance,  the  mutual 
reinforcement  is  enhanced.    Increased  positive  emphasis  on  safety 
is  then  supported  by  management.    Emphasis  solely  on  codes, 
standards  and  regulation  will  not  suffice,  nor  does  it  tend  to 
build  management  support. 

An  inherent  relation  between  energy,  control,  and 
performance  (p.  109)  underlies  much  of  what  we  undertake  in 
modem  society.    When  control  is  not  in  scale,  performance 
suffers  and  accidents  result. 

11.  A  Safety  System  as  a  General  Management  System.  We  reinvent 
nature's  biological  safety  mechanism  with  essential  feedback 
as  a  "safety  system,"  or  a  wide  variety  of  managerial  systems. 

The  beauty  of  the  simple,  six  element  system  (p.  113)  is  that 
under  it  we  can  tree  (successive  elaborations  of  essential  detail) 
everything  that  must  be  said  about  safety  methodolgy.    For  example: 

Simple  -  six  elements  -  p.  113 

Congruous  with  general 
Next  level  of  detail  -  p.  114  management  -  p.  128 

More  detail  -  M3RT 

Note  a  tree  is  a  sequence  -  left  to  right  and  top  to  bottom. 

A  tier  in  a  tree  is  a  process  -  p.  194. 

Additional  trees  can  give  more  detail,  e.g..  Independent 
Review  tree.  Exhibits  8  plus  4-7  and  9-12,  or  for  other 
subjects.  Exhibits  3  and  12. 

12.  General  Safety  Program  Theses.  A  simple  set  of  propositions 
reflects  what  has  gone  before  and  what  will  follow. 

IV.  MDRT.   The  appendix  to  this  paper  provides  the  necessary  discussion. 
If  M)RT  seems  complex,  remember  that  it  must  be  "necessary  and 
sufficient,"  and  also  provide  redundant  controls. 

V.  Management  Implementation  of  the  Safety  System.    Ten  elements 
susceptible  to  measurement  and  evaluation  are  listed  and  described. 
The  e  Lemer^ts  are  correct  and  basic  if  the  product  is  a  reactor,  a 
process  facil  "'"v,  or  a  product  used  by  others  (industry  or  government) 
with  y.  strong       :em  for  safety. 
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The  management  criteria  have  not  been  tested  on  a  consumer  product 
organization.    Product  safety  specialists  have  opinions  that  the  management 
elements  for  product  safety  are  similar,  if  not  identical.    A  study  of 
product-related  management  systems  could  bring  about  major  improvements 
in  product  safety.    This  thesis  will  be  repeated  in  the  Hazard  Analysis 
part. 

21.  Risk  Assessment  System.    Models  varying  from  simple  to  complex  are 
presented.    Probability  goals  for  safety  are  now  feasible  and  practical. 

ERDA  now  has  several  active  investigations  in  analyzing  risks  in 
transportation  of  hazardous  materials,  using  the  NTSB  model.  This 
model,  converted  to  general  organizational  problems,  is  shown  (p.  219). 

VI.    Hazard  Analysis  Process.    The  Hazard  Analysis  Process  must  be 

conceptualized  and  defined.    The  failure  to  do  so  is  probably  the 
most  glaring  single  weakness  in  present-day  professional  safety  work. 

22.  System  Safety  and  Hazard  Analysis.    Two  concepts.  Life  Cycle  and 
Safety  Precedence  Sequence,  were  well  articulated  by  NASA  (but  not 
AEC  at  the  time) . 

System  safety  costs  (perhaps  5%  of  engineering  costs,  and  a  tiny 
fraction  of  total  production  costs)  are  essentially  small.  Managers 
and  engineers  commonly  see  them  as  expensive;  this  has  never  been  shown. 
What  can  be  expensive  are  the  hardware  or  control  systems  shown 
necessary  by  analyses ;  then  trade-off studies  may  be  necessary  and  well 
based. 

23.  Hazard  Analysis  Process  Defined.    The  listing  referred  to  on  page  235 
is  "MDRT  IV,"  an  improvement  over  the  M3RT  charts  in  the  text,  but 
similar  to  the  large  chart  which  accompanied  the  Safety  Research 
Journal  (MDRT  V) . 

The  need  for  the  elements  in  this  process  has  been  confirmed  in 
spilled  blood  and  piles  of  rubbish  and  ashes.    Lack  of  articulation 
of  such  a  process  is  the  grave  weakness  in  product  and  other  design. 

To  facilitate  initiation  of  an  improved  process,  the 
simplification  shown  as  Figure  1  was  developed.    It  shows  the 
"big  six"  of  hazard  analysis  which  will  merit  brief  comment  here: 

a.  Information  search 

(1)  Codes,  standards  and  regulations; 

(2)  Accident/ incident  data.    Without  any  desire  to  relieve 
manufacturers,  the  difficult  matter  of  nationwide  product 
data  collection  and  retrieval  may  be  a  valuable  service  for 
government  action. 

b.  Change  Analysis,  already  discussed. 
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c.  Failure  IVfode  and  Probability/ Consequences  analysis  of  residual 
priority  problem  lists . 

d.  Human  Factors  Review,  covered  in  MDRT  chapter  26.    The  MORT  tree 
analysis  shown  follows  common  practices,  but  has  demonstrated  no  f 
efficacy  in  upgrading  investigations  or  reviews  by  untrained 
personnel.    We  fell  back  on  a  classification  of  skill  levels,  a 
low  threshold  of  a  "cookbook"  or  a  sensitizing  course  such  as  the 
Aerojet  manual  cited  at  the  outset.    The  skill  applied  to  product 
design  is  easily  classifiable,  and  the  threshold  should  be  a 
minimum  requirement  in  modem  society.    Here  standards  for  design 
will  not  suffice. 

e.  MDRT  analysis. 

f.  Nonnormal  operating  modes- -start  up,  shut  down,  repair,  failure, 
anomalies,  etc. --search  is  a  test  of  imagination. 

The  final  level  of  required  system  safety  analysis  is  negotiable 
from  a  scaling  mechanism- -big  problems,  big  analysis- -and  for  a 
major  system  safety  effort.    Hammer  is,  again,  the  best  guide. 

We  can  now  return  to  some  of  the  other  major  elements  in  Figure  1 
Good  Design  Organization  (Chapter  27) .    Strangely,  a  general  format 
of  a  design  process,  onto  which  a  safety  process  can  be  easily 
fastened,  is  apparently  lacking.    The  points  of  interactions, 
particularly  early  safety  input,  should  be  defined. 

The  role  of  reliability  and  quality  assurance  are  understated 
in  MDRT  (1973),  especially  for  product  safety. 

What  is  called  for  is  a  three-level  investigation  or  audit  of  a 
product  design  function: 

a.  Basic  design  organization. 

b.  Quality  assurance  aspects  (p.  281). 

c.  Hazard  analysis  process  (p.  235). 

Only  the  three  in  combination  could  give  assurance  of  an  error - 
free  design  process. 

Independent  Review.    This  concept  was  apparently  invented  by  the 

AEC,  and  it  is  a  powerful  factor  in  detecting  oversights  and  omissions 

Trade-offs  are  not  a  functional  point  of  design  clearly 
called  out  in  MDRT.    Safety  is  a  frequent  loser  in  trade-off  sessions 
because  the  predictive  safety  data  for  cost/benefit  con5)arisons  are 
weak  relative  to  other  concerns.    Therefore,  the  injuction  to 
always  put  in  the  values  is  made,  which  will  be  clear  when  serious 
accidents  occur  (p.  256) . 
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Historical  Note.    The  automobile  industry  can  under  excrutiating 
pain  in  Senate  hearings  in  1963  and  1964.    Its  management 
policies  and  implementation,  its  safety  research,  its  hazard  analysis 
process,  and  its  trade-offs  fstyle  for  safety)  were  found  less  than 
adequate  (LTA  in  JVDRT) .    One  company  president  has  said  he  wishes 
he  knew  prior  to  1963  what  he  now  knows.    The  lesson  for  other 
manufacturers  seems  clear- -audit  and  measure  processes  against 
ideals,  or  public  agencies  will. 

VII.  The  Work  Flow  Process 

Operational  Readiness  is  a  test  not  covered  in  M3RT,  but  not  has  the 
Aerojet  guidelines  listed  above.    The  process  therein  shows  analytic  trees 
which,  with  slight  adaptation,  could  be  used  to  determine  that  a 
manufacturer  was  ready  to  produce  a  safe,  trouble-free  product. 

However,  a  simple  guideline  for  universal  use  is  the  Nertney  Wheel 
Cp.  254). 

With  one  exception.  Procedures,  the  factors  of  Supervision,  Employee 
Training  and  Performance  Motivation  seem  inappropriate  for  consumer 
product  technology. 

Procedures  (chapter  32) .  Tested  criteria  for  evaluating  procedures 
are  listed.  (Seven  of  ten  procedures  in  a  well-run  organization  flunked 
the  test.)  It  seems  likely  most  manufacturers'  procedures  would  show  at 
least  as  high  a  failure  rate. 

New  View  on  a  Human  Factors  Process.    M3RT  divides  the  human  aspects 
into  several  pieces,  remotely  classified  as  relevant  to  a  MDRT  process. 
To  tie  it  all  together.  Figure  2  was  developed.    The  following  numbered 
notes  explain  the  steps  in  the  process.    (Other  steps  are  clear,  or  see 
MDRT  index.) 

(1)  Any  number  of  tests  and  guides .    See  special  bibliography  in 
^DRT. 

(2)  See  Procedures  above  and  IVDRT,  Chapter  32. 

(3)  Behavior  change  -  Appendix  H,  Innovation  Diffusion,  and 
Appendix  I,  Acceptance  of  Proceduralized  Systems. 

(4)  M^ger  and  Pipe,  Analyzing  Performance  Problems,  Lear  Siegler,  Inc. 
Fear on  Publishers,  Belmont,  California,  1970. 

It  should  be  most  fruitful  to  measure  the  Human  Factors  Process  as  it 
would  bear  on  designers  in  an  organization.    They  are  people,  and  need 
support  and  assistance. 

VIII.  Information  Systems.    The  specific  criteria  listed  343  would 
likely  not  be  fulfilled  by  a  product  data  system.    Again,  government 
may  have  a  role  to  fill.    The  manufacturer  does  have  certain 
inescapable  obligations. 
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36.  Technical  Information.    Can  be  well  organized  and  approach  comprehensive 
change . 

37.  Monitoring  Systems.    Some  can  be  developed. 

a.  Error  sampling  is  possible  by  field  study. 

b.  Failure  reporting,  especially  from  controlled  groups,  such  as 
customer  service. 

c.  Critical  Incident  Studies  (called  RSO's  in  IVDRT  because  they  are 
not  "critical"  in  a  nuclear  industry!).    This  is  a  powerful  and 
perceptive  tool  for  product  design. 

d.  Accident/ incident  reporting  systems. 

Data  reduction  for  management  or  design  use  is  required. 

38.  Accident  Investigation.    See  the  new  Manual.    A  few  thorough,  in  depth 
investigations,  including  a  manufacturer's  investigations  of  the  role 
of  his  systems,  will  provide  more  useful  data  than  superficial 
investigations  of  many  hundreds  or  thousands  of  accidents.  ERDA 
investigations  of  serious  events  reveal  on  the  order  of  forty 
organizational  improvement  possibilities  per  case,  about  half  being 
system  improvements. 

Audits  of  design,  production,  quality  assurance  and  other  relevant 
programs  by  high  level,  independent  groups  (internal  or  external)  have 
been  shown  to  be  powerful  and  searching  methods  of  discovering  needed 
improvements,  particularly  when  good  audit  and  process  criteria  are  used. 

39.  The  Organization's  Information  System.    This  section  extends  earlier 
comments  and  findings.    Primary  is  the  finding  that  EDP  coded  systems 
in  industry  have  produced  information  of  modest  diagnostic  value,  but 
almost  no  information  for  action  decisions. 

40.  National  Information  System.    Nfe.ny  pieces  and  parts  are  available  but 
not  tied  together.    Therefore,  a  designer  is  placed  under  an  unwarranted 
handicap.    Governmental  initiative  seems  necessary  to  make  diverse 
information  stores  easily  accessible  to  smaller  organizations. 

41.  Measurement  Techniques. 

a.  The  Frequency-Severity  Matrix  is  further  developed  (p.  420). 

b.  Extreme  Value  Predictions  (p.  426)  are  proving  to  be  a  useful 
means  of  estimating  the  probability  of  more  serious  events  from 
past  "worst  event"  data.* 


*Gumbel,  Emil  J.    "Statistical  Theory  of  Extreme  Values  and  Some  Practical 
Applications,"  National  Bureau  of  Standards,  Applied  Mathematics  Series,  1954. 
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c.    Simplistic  rates  commonly  used  in  industry  to  measure  industrial 
safety  performance  are  of  slight  value  (p.  432) .  Also 
see  Appendix  K  for  results  of  an  NSC  Symposium  on  Measurement, 
pertinent  for  many  safety- related  problems. 

*  *  * 

In  summary,  the  experiences  of  the  last  six  years  suggest  the 
following  needs : 

1.  A  compilation  or  synthesis  of  the  best  available  practices 
to  form  an  ideal  measurement  yardstick. 

2.  Systematic  investigation  of  accidents  in  sufficient  depth 
to  modify  and  inprove  the  ideal  system.  (A  "state  of  the 
art"  for  the  next  three.) 

3.  Pilot  tests  and  evaluations  of  the  system. 

4.  Research  and  evaluation  under  conditions  where  variables 
are  at  least  known,  even  if  not  quantified. 

5.  Implementation  is  a  long-term  project,  five  to  ten  years. 
However,  short-term  gains  result  from  each  improvement; 
differences  can  be  seen  within  a  year. 

These  needs  apply  directly  to  product  safety  and  commercial 
transportation,  and  perhaps  other  fields  as  well. 
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mrOTHESIS  GENERATION  FOR  RARE  EVENTS  RESEARCH 


Ludwig  A.  Benner,  Jr. 
National  Transportation  Safety  Board 

LUDWIG  BENNER,  JR.  is  Chief  of  the  Hazardous 
J^terials  Safety  Division  of  the  Bureau  of  Surface 
Transportation  Safety,  National  Transportation 
Safety  Board.    Mr.  Benner  has  long  been  involved 
with  transportation  safety  in  a  number  of  capacities. 
His  paper  deals  with  the  process  of  discovery, 
suggesting  that  hypothesis  development  in  accident 
investigations  and  rare  event  research  need  not  be 
a  hit  or  miss  proposition  based  primarily  on 
"creative  intuition"  and  "good  luck."  Rather, 
Benner  proposes  a  multilinear  events  sequencing 
methodology  to  aid  in  the  development  and  testing 
of  research  hypothesis.    The  interested  reader  is 
referred  especially  to  Benner,  L. ,  Accident 
investigations:    Niiltilinear  events  sequencing 
methods.    Journal  of  Safety  Research,  1975,  7^(2), 
67-73,  for  a  more  complete  discussion  of  the 
proposed  methods. 

INTRODUCTION 

This  paper  focuses  on  hypothesis  generation.    How  does  one  generate 
propositions  that  can  be  tested  by  scientific  methods?    Popper  (1959) 
says  there  is  no  logical  path  leading  to  new  ideas --they  can  only  be  reached 
by  "emfuhlung"  or  creative  intuition.    Polya  (1957)  offers  a  "rule 
of  discovery"  that  goes  about  like  this:    the  first  rule  of  discovery  is  to 
have  brains  and  good  luck;  the  second  is  to  sit  tight  and  wait  until  you 
get  a  bright  idea.    Their  views  are  widely  held. 

Surry's  (1969)  discussion  of  accident  research  methodology  is  useful  if 
further  understanding  of  some  of  the  difficulties  with  existing  accident 
research  are  of  interest  to  the  reader.    But  Surry  does  not  discuss  the 
discovery  problem. 

The  problem  of  structuring  discovery,  especially  the  discovery  of 
hypothesis,  has  been  with  us  for  a  long  time.    There  may  be  a  way  to  do  it. 
I  would  like  to  share  with  you  my  method  for  generating  hypotheses,  derived 
from  my  work  as  an  accident  investigator. 

WHAT  HAPPENED? 

After  an  accident,  every  investigator  is  confronted  with  the  need  to 
answer  the  question  "what  happened"  regardless  of  the  ultimate  purpose  of 
his  investigation.    The  usual  approach  is  to  try  to  "reconstruct"  the 
accident.    The  method  used  is  to  try  to  isolate  events  suggested  or  indicated 
by  evidence  acquired  after  , the  accident.    As  the  investigator  becomes  aware 
of  events  that  occurred  during  the  accident,  outlines  of  what  happened 
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begin  to  emerge.    As  additional  evidence  of  events  comes  to  light,  the 
investigator  begins  to  speculate  about  possible  hypotheses,  that  is, 
ways  the  accident  might  liave  happened.    Each  hypothesis  is  tested  against 
the  evidence  subsequently  developed,  to  arrive  at  the  most  likely 
explanation  of  what  happened. 

As  I  have  observed  this  process,  elements  common  to  the  search  for 
understanding  of  any  phenomenon  have  been  noted.    These  observations 
suggest  that  there  may  be  a  logical  path  leading  to  new  ideas,  and  that  a 
general  method  for  generating  hypothesis  during  the  study  of  phenomena, 
including  rare  event  phenomena,  may  be  possible.    The  essential  assumptions 
and  principles  follow. 

EVENTS  SEQUENCING 

My  hypothesis  generation  method  is  based  on  the  premise  that  the 
functioning  of  our  universe  and  its  constituent  parts  reflects  a  continuum 
of  interacting  events.    Events,  in  this  context,  are  used  in  the  sense  that 
someone  or  something  does  something  (actor  +  action  =  event) .    Each  event 
influences  one  or  more  events  which  follow  that  event  in  time.    It  is  the  preced 
follow  logic  of  the  related  events  that  provides  the  key  to  the  hypothesis 
generation  method. 

The  accident  investigation  process  is  based  on  a  "break  down  events" 
principle.    Take  "an  accident"  and  break  it  down  into  increasingly  finite 
events  in  the  following  manner.    "An  accident  occurred"  describes  a 
phenomenon  as  a  gross  event.    "A  sliding  car  struck  a  tree"  breaks  down  the 
gross  event  into  two  subevents .    The  car  rolled  onto  an  icy  patch,  began  to 
slide,  and  struck  a  tree  further  breaks  down  the  phenomenon  into  even  more 
discrete  events.    This  "break  down"  process  can  be  continued  for  as  long  as 
necessary  to  gain  the  understanding  of  the  phenomenon  required  by  the  purpose 
of  the  study.    Each  time  an  event  is  subdivided,  the  need  for  more  precise 
understanding  of  the  actor- action  relationships  arises.    And  each  time 
the  need  arises,  the  last  known  action  by  an  actor  provides  a  starting  point 
to  hypothesize  the  next  action  or  actions  that  must  have  been  taken  by  that 
actor  in  order  for  him  to  arrive  at  the  next  known  action  supported  by  the 
evidence.    Thus,  the  bridging-  of  the  events  gaps  is  circumscribed  by  logical 
spatial  and  temporal  relationships  among  the  events  as  they  progress  through 
their  precede/f ollow  sequence.    This  method  of  "breaking  down"  the  events 
sequence  structures  the  discovery  of  unknown  events  required  for  the 
sequence  to  proceed  from  the  beginning  point  to  the  end  point  of  the 
phenomenon  being  studied. 

Usually  for  someone  or  something  to  do  something  (an  event  to  occur) 
certain  enabling  conditions  must  exist.    The  creation  of  these  conditions 
also  flows  from  an  event  sequence.    That  is  to  say,  events  produce  changes 
of  state  or  outcomes.    For  any  phenomenon  under  study,  the  chronological 
flow  of  events  provides  an  explanation  of  what  happened,  just  as  we 
naturally  try  to  create  mental  movies  when  we  attempt  to  describe  events. 
The  existence  of  the  enabling  conditions ,  which  must  have  been  present  for 
each  event  to  occur,  can  be  traced  backward  in  time  to  explain  "why"  the 
events  sequences  occurred. 
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A  convention  for  displaying  the  events  sequences,  which  further 
facilitates  discussion  and  discovery,  has  been  proposed  where  the  events 
sequences  involve  two  or  more  actors  (Benner,  1975).    This  multilinear  events 
sequencing  method  provides  opportunity  for  a  precede/follow  logic  check  along 
both  the  horizontal  time  coordinate  for  a  single  actor  as  well  as  a  vertical 
time  coordinate  for  sequencing  related  events  by  two  or  more  actors.  In 
other  words ,  the  timing  of  any  event  by  any  actor  can  be  compared  with  any 
other  event  by  any  other  actor,  and  this  chronological  validation  provides 
a  method  for  "proving"  the  hypothesis  that  differs  from  traditional, 
statistical,  or  experimental  approaches  of  the  scientific  method.  The 
display  has  the  further  advantage  of  highlighting  unknown  "linking"  events 
in  the  sequence.    It  can  also  structure  speculations  about  their  occurrence 
or  guide  the  search  for  evidence  to  confirm  these  speculations . 

RARE  EVENTS  RESEARCH 

The  multilinear  events  sequencing  methodology  can  be  useful  for 
predictive  study  of  rare  events  or  accident  phenomena.    If  one  can 
accept  that  accidents  are  multi-event  phenomena  involving  more  than  one 
actor,  whose  actions  must  occur  in  a  specified  chronological  sequence  to  achieve 
a  harmful  or  other  outcome  of  interest,  it  can  readily  be  seen  that  if 
any  of  the  events  occur  out  of  sequence  (or  not  at  all)  the  outcome  being 
studied  will  not  occur.    Thus  the  pattern  of  events  describing  the  "rare 
event  phenomenon"  can  be  studied.    It  is  the  occurrence  of  the  events  sets 
in  the  necessary  relationship  which  is  rare,  rather  than  the  occurrence  of 
individual  events  within  the  set. 

If  this  concept  is  valid,  it  suggests  new  approaches  for  the 
accumulation  of  data  about  rare  events  in  the  form  of  events  sets, 
rather  than  in  the  form  of  individual  conditions  on  events  constituting 
the  phenomenon.    The  manipulation  of  chronologically  sequenced  events  sets 
in  process  flow  chart  form  appears  to  hold  more  promise  in  understanding 
rare  events  phenomena  than  the  present  approaches.    In  the  accident  field, 
the  need  for  a  unifying  theoretical  framework  to  organize  the  events  sets 
for  research  purposes  can  be  shown  to  be  increasingly  urgent.    A  theory  which 
would  accommodate  the  sequential  ordering  of  events  sets  in  accident 
and  other  rare  events  research  has  been  proposed  by  the  author  (1975) . 

Summary 

The  sequential  ordering  and  display  of  events  and  events  sets 
constituting  a  rare  phenomenon  provide  a  reproducible  method  for 
structuring  the  discovery  of  a  hypothesis  explaining  the  phenomenon, 
and  for  testing  the  logic  of  the  explanation.    The  application  of 
probabilistic  estimates  of  the  frequency  of  occurrence  of  these  events, 
both  individually  and  in  sets,  provides  an  approach  for  predicting  these 
phenomena.    Time  or  spatial  logic  tests,  as  well  as  traditional  mathe- 
matical or  other  experimental  methods,  can  then  be  used  to  validate 
one's  hypothesis. 


27 


References 


Benner,  L.    Accident  Investigations:    Multilinear  Events  Sequencing  Methods, 
Journal  o£  Safety  Research,  7:2.  June  1975. 

Polya,  G.    How  to  Solve  It,  Doubleday -Anchor  Books,  Second  Edition, 
Garden  City,  New  Jersey,  1957. 

Popper,  Karl    The  Logic  of  Scientific  Discovery,  Basic  Books,  Inc., 
New  York,  New  York,  1959. 

Surry,  J.    Industrial  Accident  Research,  University  of  Toronto,  1969. 


28 
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JULIM  A.  WALLER  is  a  professor  and  chairman, 
Department  of  Epidemiology  and  Environmental 
Health  in  the  IMiversity  of  Vermont  College 
of  Medicine.    Active  in  the  field  of  injury 
control  since  1960,  Dr.  Waller  is  the  author 
of  a  large  number  of  research  papers,  articles, 
and  books  about  the  roles  of  medical  conditions, 
alcohol  and  other  drugs  in  injury,  the  improvement 
of  emergency  health  services,  product  safety, 
and  other  aspects  of  home,  recreational  and 
highway  safety. 

Waller's  paper  begins  with  a  brief,  and 
excellent,  overview  of  epidemiology  and  two 
basic  designs  used  by  epidemiologists  for  testing 
hypotheses  about  determinants  of  injury,  namely, 
the  case  history  and  cohort  methods.  Waller 
then  discusses  two  epidoniologic  methods  based 
on  the  interaction  between  the  host  (victim) 
and  the  injury  agent  (physical  energy) .  The 
first  model  presented  deals  with  determining 
causes  while  the  second  is  concerned  with  identifying 
the  range  of  countermeasures  options. 

One  of  the  unique  things  about  the  field  of  injury  control  is  that 
it  is  not  a  field.    Rather,  as  best  I  can  determine,  it  is  a  side  interest 
or,  more  correctly,  a  nuisance  issue  for  several  different  professional 
groups -- engineers ,  ergonomists,  psychologists,  systems  specialists,  arch- 
itects, highway  and  vehicle  builders,  designers  of  various  types,  lawyers, 
physicians,  chemists  and  administrators,  to  mention  a  few.  Consequently, 
the  construction  of  a  unified  approach  to  research  about  or  control  over 
injury  is  something  akin  to  building  the  biblical  Tower  of  Babel.  Each 
profession  has  its  own  concepts,  terminology,  and  acknowledged  experts, 
all  of  which  are  largely  unknown  to  members  of  other  professions  who 
may  be  equally  concerned  about  injury  as  a  social  and  economic  problem. 

This  fact  has  been  repeatedly  brought  home  to  me  as,  during  the 
past  several  months  of  a  sabbatical,  I  have  attempted  with  increasing 
frustration  to  write  a  book  covering  all  aspects  of  injury  control. 
It  is  almost  impossible  to  search  out  all  the  sources  where  appropriate 
literature  or  information  might  be  found,  to  always  understand  what  is 
being  said  once  I  have  obtained  the  data,  or  to  translate  my  material 
into  language  that  will  be  sufficiently  acceptable  to  all  groups  who 
need  to  see  it. 
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Just  recently,  in  a  long  conversation  with  a  systems  safety  specialist 
whom  I  have  known  for  some  years,  I  suddenly  realized  that  his  conception 
of  epidemiology  was  quite  different  from  the  realities  of  the  field, 
as  was  my  concept  of  the  systems  approach.    Therefore,  I  welcome  the 
opportunity  to  explain  to  others  the  epidemiologic  approaches ,  their 
strengths  and  limitations.    I  strongly  suspect  that,  if  all  approaches 
of  epidemiologists  and  other  professionals  are  laid  on  the  table,  it 
will  be  apparent  that,  despite  differences  in  terminology,  they  often 
seem  to  draw  upon  similar  intellectual  processes  and  have  much  in  common. 

I.    What  is  Epidemiology 

As  one  might  infer,  the  term  epidemiology  comes  from  the  study  of 
epidemics,  or  disease  frequencies  that  are  significantly  above  the  expected 
norm  for  a  population  at  a  given  time.    As  communicable  diseases  began 
to  decline  somewhat  as  a  major  cause  of  death  and  disability  in  the  western 
world,  other  uses  were  found  for  epidemiologic  tools  and  concepts  so 
that  now  the  techniques  are  applied  more  often  to  the  study  of  chronic 
diseases ,  environmental  problems ,  health  services ,  and  the  evaluation 
of  countermeasure  programs,  all  areas  relevant  to  injury  and  its  amelioration. 

Briefly  stated,  epidemiology  is  the  study  of  the  distribution  and 
determinants  of  disease  or  other  phenomena  in  a  population.  Several 
aspects  of  this  need  to  be  emphasized.    First  and  foremost,  epidemiology 
is  population  based,  getting  its  data  not  from  theory  or  laboratory  or 
simulation,  but  directly  from  observation  of  the  real  world,  with  all 
the  concomitant  advantages  and  disadvantages. 

Second,  the  study  of  distribution  implies  that  the  epidemiologist 
starts  with  the  expectation  that  the  phenomenon  to  be  examined  may  not 
be  distributed  randomly  but  rather  follows  specific  nonrandom  patterns, 
and  for  explainable  reasons.*    This  also  means  that  proper  study  requires 
examination  not  only  of  those  times  or  segments  of  the  population  in 
which  the  phenomenon  exists,  but  also  for  the  times  or  segments  in  which 
it  does  not  exist,  i.e.,  the  control  or  comparison  population. 

Here  we  already  begin  to  get  into  trouble.    A  phenomenon  may  be 
thought  not  to  exist  in  a  population  or  at  a  given  time  simply  because 
although  present,  it  cannot  be  observed.    Unlike  clinical  medicine,  which 
deals  predominantly  with  correction  or  prevention  of  health  problems 
which  are  obvious,  epidemiology  deals  with  what  is  known  as  the  "biologic 
gradient"  of  disease.  This  term  simply  means  that,  if  studied  carefully 
enough,  virtually  all  disease  will  be  found  to  vary  not  only  in  frequency 
but  also  in  severity,  again  for  explainable  reasons.    Thus,  a  disease 
may  be  present  but  not  observable  (i.e.,  subclinical)  in  some,  mild, 


^Because  injury  events  are  not  random  they  should  not  be  called  "accidents," 
a  term  which  has  connotations  of  randomness  (and  consequently  inability  to 
change)  and  also  prescient if ic  connotations  of  acts  of  God,  punishment  for 
sinfulness,  carelessness,  etc. 
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moderate,  or  severe  in  others,  and  also  fatal  on  occasion.    The  distribution 
of  this  gradient  varies  with  the  phenomenon  and  the  circumstances.  Thus, 
the  epidemiologist  is  concerned  both  with  frequency  and  severity. 

Third,  the  study  of  determinants  involves  identifying  why  a  phenomenon 
is  nonrandomly  distributed  as  opposed  to  the  previous  question  of  how 
the  distribution  is  nonrandom.    Here,  again,  some  basic  tenets  should 
be  noted.  In  studying  determinants  one  commonly  examines  the  host  (i.e., 
person  or  other  living  thing  affected  by  the  phenomenon) ,  the  agent  (or 
factor  necessary  for  the  phenomenon  to  occur)  and  the  environment  which 
may  modify  frequency,  severity,  or  both.    Also  of  importance  may  be  the 
vectors,  or  vehicles  by  which  the  agent  is  carried  to  the  host. 

Some  nonepidemiologists  with  whom  I  have  spoken  are  under  the  impression 
that  epidemiology  seeks  out  single  causes.    While  it  can  be  and  often 
is  used  for  this  purpose,  it  is  most  important  that  one  of  the  basic 
tenets  is  that  a  single  cause  may  have  multiple  effects  and  that  a  single 
effect  may  be  the  result  of  several  causal  factors.    In  some  cases,  these 
causal  factors  may  be  capable  of  producing  a  single  effect.    In  other 
cases,  the  effect  may  occur  only  if  two  or  more  factors  are  present  simulta- 
neously or  in  tandem.    In  the  study  of  injury  there  have  been  far  too 
few  sophisticated  studies  philosophically  oriented  toward  and  capable 
of  examining  a  multitude  of  factors  simultaneously.    This  is  a  fault  of 
the  users,  rather  than  of  the  capabilities  of  the  field. 

Although  there  have  been  many  variations,  two  basic  designs  exist 
for  testing  hypotheses  about  determinants,  and  a  brief  discussion  of 
the  advantages  and  disadvantages  of  each  of  these  designs  is  warranted. 
Both  designs  require  examination  of  two  populations  over  two  time  frames, 
the  so-called  2x2  model. 

The  case  history  or  case-control  method  involves  comparison  of  a 
population  that  has  the  disease  (in  this  case  injury  or  events  capable 
of  producing  it)  with  a  population  that  does  not  have  the  disease.  It 
thus  starts  with  the  second  time  frame,  that  is  after  the  disease  has 
occurred.    Then,  through  questioning,  study  of  old  records,  etc.  this 
method  attempts  to  determine  how  often  factors  hypothesized  to  be  causal 
existed  during  the  period  antecedent  to  the  disease. 

Applied  to  injury,  the  researcher  would  compare  persons  fatally 
injured  in  crashes  with  those  not  involved  in  crashes  to  determine  how 
often  each  group  had  alcohol  present.    The  "hooker"  is  that  since  the 
data  are  from  the  real  world  the  populations  being  compared  may  differ 
also  in  many  factors  other  than  alcohol,  some  of  which  may  be  equally 
or  even  more  relevant  to  the  occurrence  of  injury  events.    Thus,  the 
epidemiologist  attempts  to  match  the  ill  and  well  populations  for  as 
many  variables  as  possible,  leaving  unmatched  only  those  which  are  subject 
to  hypotheses. 

The  advantages  of  the  case  history  method  are  that  it  is  relatively 
quick,  inexpensive,  and  can  be  applied  to  rare  events.  The  disadvantage 
is  that  it  cannot  be  used  to  describe  the  absolute  frequency  with  which 
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the  disease  occurs  in  populations  with  or  without  the  causal  factor  in 
question.  For  this,  one  must  turn  to  the  cohort  method  which,  in  turn, 
has  disadvantages  of  high  cost,  much  longer  time  frame  for  completion 
of  the  study,  and  inability  to  examine  rare  events. 

The  cohort  method  is  the  exact  reverse  of  the  case  history  approach. 
The  two  populations  identified  are  those  with  and  without  the  variable 
or  variables  hypothesized  to  cause  disease  or  to  affect  its  severity. 
Both  populations  are  then  followed  over  a  specified  time,  and  the  resulting 
proportions  with  disease  or  with  greater  severity  are  then  compared. 

Again  applied  to  injury,  using  the  case  history  method  one  could 
say  that  42%  of  fatally  injured  drivers  but  only  3%  of  drivers  not  in 
crashes  but  with  similar  driving  exposure  have  blood  alcohol  concentrations 
of  .10%  by  weight  or  greater.    Using  the  cohort  method,  it  would  be  possible 
to  say  that  the  risk  of  crashing  per  100,000  miles  of  driving  is  pi  with 
no  alcohol  present  and  P2  with  a  BAG  of  .10%.    Of  course,  the  cost  of 
following  two  such  populations  using  the  cohort  method  is  prohibitive, 
and  there  are  very  serious  and  insurmountable  ethical  issues  regarding 
permitting  persons  impaired  by  alcohol  to  drive  and  to  expose  themselves 
and  others  to  the  risk  of  crashing. 

II.    Relation  Between  Epidemiologic  and  Other  Methods 

What  are  the  relationships  of  epidemiologic  methods  to  other  ways 
of  studying  injury  events  for  purposes  of  establishing  countermeasures? 
Important  similarities  and  differences  exist.    One  similarity  is  the 
creative  process.  Whether  the  method  involves  epidemiology,  psychology, 
system  design,  simulation,  or  any  other  approach,  the  result  will  be 
no  better  than  the  capability  of  the  researcher  to  do  modeling,  that 
is,  to  identify  all  of  the  potentially  relevant  cells  or  branches,  to 
establish  cogent  hypotheses ,  and  to  design  acceptable  methods  for  testing 
them.    I  would  suggest  that  the  approach  to  an  injury  problem  commonly 
goes  something  like  the  following: 

1 .  Hypotheses  are  established  based  on  anecdote  or  unorganized 
observation. 

2.  The  hypotheses  are  tested  through  epidemiologic,  sociologic,, 
or  possibly  engineering  analysis  of  real  world  experience  and  through 
selected  laboratory  simulation. 

3.  Building  upon  data  about  frequency,  severity,  and  causal  factors 
so  obtained  system  designing  then  begins  to  take  place,  identifying  all 
possible  component  branches  that  need  to  be  considered,  dealing  with 

types  of  failures  that  may  occur,  relative  probabilities  and  likely  results. 
Of  course,  one  can  design  a  theoretical  fault  tree  involving  a  totally 
new  product  or  situation.    But  even  here  the  designer  builds  upon  previous 
experience  using  data  drawn  from  other  potentially  applicable  situations. 

4.  Testing  and  further  development  of  the  system  model  takes  place 
through  additional  epidemiologic,  laboratory  and  other  studies,  including 
simulation. 
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5.  Priorities  for  coimtermeasures  are  established  based  upon  selection 
of  those  aspects  of  the  problem  that  seem  to  be  associated  either  with 
greatest  frequency,  severity,  or  both,  and  that  simultaneously  have  greatest 
likelihood  of  feasibility.    By  feasibility,  I  refer  not  only  to  technical 
and  economic  issues  but  also  to  social,  legal,  cultural,  and  other  issues 
that  form  the  warp  and  weft  of  human  society.    For,  as  Henry  Wakeland 

has  aptly  noted,  this  nation  "has  never  been  satisfied  to  serve  only 
one  set  of  values". ^    Wakeland  has  recently  published  a  paper  i^^ich  considers 
18  values  related  to  safety  and  other  social  issues  in  assessing  the 
expected  success  of  different  countermeasures . -I-    These  values  can  be 
further  grouped  into  the  following  categories: 

a)  economics 

b)  public  image  and  psychological  motivation 

c)  equality  and  fairness 

d)  deservedness  of  protection 

e)  critical  position  in  a  technical  system 

f)  timing 

6.  Finally,  one  or  more  count ermeasures  may  be  applied.    If  fortune 
smiles,  arrangements  have  been  made  to  permit  adequate  evaluation.  Here 
again,  epidemiologic  methods  may  come  into  play. 

It  must,  of  course,  be  immediately  apparent  that  the  methods  and 
concepts  used  by  epidemiologists  are  not  limited  to  this  professional 
group,  any  more  than  methods  of  other  professionals  are  used  by  them 
alone.    Several  of  the  above  steps,  and  occasionally  even  all  of  them, 
may  be  carried  out  either  by  a  single  individual  or  professional  group, 
or  by  members  of  a  number  of  professions . 

I  hasten  to  note  that  most  of  the  epidemiologic  research  in  the 
field  of  injury  control  has  been  concerned  with  examining  the  distribution 
and  determinants  of  injury  events  and  of  the  severity  of  such  events. 
This  has  led  to  proposals  for  countermeasures ,  the  effectiveness  of  which 
has  been  evaluated  in  relatively  few  cases. 

Almost  entirely  nonexistent  has  been  either  epidemiologic  or  sociologic 
research  into  the  "process"  by  which  injury  control  priorities  are  either 
established  and  implemented,  or  sought  but  blocked.    Why,  for  exan^Dle, 
despite  years  of  documentation  about  their  value  is  it  so  difficult  to 
obtain  adequate  regulations  and  legislation  for  use  of  seatbelts  and 
other  passenger  restraints  or  to  keep  such  legislation  for  motorcycle 
helmets?    Why  at  the  same  time  is  there  such  concern,  effectively  translated 
into  congressional  action,  about  the  safety  of  school  busses,  when  a 
bus  program  may  save  the  lives  of  only  30-40  persons  per  year,  and  then 
only  at  great  cost? 

Why  has  the  National  Transportation  Safety  Board  had  such  a  poor 
batting  record  in  convincing  others  to  adopt  its  countermeasure  proposals 
despite  extensive  and  thoughtful  system  modeling?    Recent  studies  from 
the  National  Bureau  of  Standards  show  that  sodium  chloride  mordant  in 
i:5)holstery  fabrics  may  add  to  the  toxicity  of  fumes  when  such  fabrics 
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bum.    Why  is  there  resistance  within  the  Department  of  Commerce  to  applying 
the  results  of  this  work  toward  reduction  of  deaths  from  fire?  Research 
is  no  more  useful  than  the  applications  to  which  it  is  put.    And  much 
more  research  about  the  whys  and  why  nots  of  this  application  process 
is  needed. 

I  noted  earlier  that  in  looking  for  causal  factors  that  might  affect 
frequency  and  severity  the  epidemiologist  seeks  out  clues  about  the  host, 
agent,  and  environment.    Through  work  by  Gibson^  and  by  Haddon^  the  agent 
in  injury  events  has  been  identified  as  physical  energy  (chemical,  thermal, 
kinetic,  electrical,  or  radiation)  transferred  to  the  body  in  sufficient 
quantity  and  at  rapid  enough  rate  to  damage  tissues .    The  following  are 
two  epidemiologic  models  based  on  the  interaction  with  this  agent.  The 
first  model  is  concerned  more  with  identifying  causes  wMle  the  second 
deals  with  identifying  the  range  of  countermeasure  options. 

III.    A  Model  for  Injury  Occurrence  and  Outcome 

The  safe  use  of  energy  that  has  been  massed  by  man,  or  the  safe 
exposure  of  humans  to  forms  of  energy  massed  by  nature,  depends  on  two 
generic  factors --the  level  of  functioning  of  the  person  and  the  demands 
of  the  task  inherent  in  making  the  energy  serve  the  functions  we  wish. 

Each  person  has  certain  capabilities  which  vary  from  moment  to  moment 
and  from  one  person  to  another.    One  of  these  capabilities  is  one's  knowledge 
about  one's  self  in  relation  to  different  aspects  of  the  environment. 
Such  knowledge  depends  upon  basic  intelligence,  experience,  education, 
short  and  long  term  memory,  and  attitudes  and  belief  systems  which  one 
may  bring  as  cultural  heritage.    Another  capability  is  the  ability  to 
receive  information  about  the  environment  through  inherent  senses  such 
as  sight,  hearing,  touch,  smell,  taste,  vibratory  sense,  and  vestibular 
function. 

Yet  a  third  attribute  is  the  ability  to  make  rapid  judgements  about 
one's  self  in  relation  to  the  environment  as  a  result  of  the  combination 
of  information  received  through  the  senses  and  knowledge  applied  in  interpreting 
such  information.  Finally,  there  must  be  the  capability  to  act  in  response 
to  judgements  that  suggest  danger  may  exist.    In  order  to  act  effectively 
to  the  variety  of  tasks  that  we  must  perform  daily,  a  person  usually 
must  have  range  of  motion,  strength,  stamina,  speed,  and  balance. 

In  summary,  therefore,  each  person  must  have  the  capability  to  receive 
information  correctly,  process  it  in  timely  fashion,  and  react  appropriately. 

What  are  some  common  task  demands?    Some  tasks  are  extremely  con^lex, 
requiring  extensive  learning,  judgement,  intelligence,  or  all  three. 
Other  tasks  require  use  of  several  senses  simultaneously,  or  the  ability 
to  pay  attention  to  multiple  stimuli  or  signals  at  one  time.    In  other 
cases,  there  is  a  requirement  for  quick  action,  dexterity,  strength, 
balance,  or  stamina.    Tasks  may  vary  in  demand  not  only  from  one  task 
to  another,  but  also  for  a  single  type  of  task  over  time.    In  general, 
the  more  automated  the  task  the  easier  it  is  to  perform  and  the  more 
consistent  is  it  likely  to  be. 
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The  Pre -Injury  Phase 


Let  us  now  put  the  person  with  his  or  her  capabilities  and  limitations 
together  with  the  task  and  its  unique  set  o£  demands.    As  long  as  the 
actual  performance  of  the  person  exceeds  the  demands  of  the  task  at  all 
times  there  is  no  likelihood  that  an  event  potentially  capable  of  producing 
injury  will  result  from  the  interaction.    If  for  any  reason,  however, 
the  task  exceeds  the  performance  level  the  energy  being  managed  or  controlled 
by  the  task  is  no  longer  in  control  and  may  be  available  to  cause  injury. 

This  moment  at  which  task  demand  exceeds  the  performance  is  commonly 
referred  to  as  an  "accident"  by  the  public. 

Three  types  of  situations  exist  in  which  the  demands  of  a  task  may 
momentarily  at  least  exceed  the  performance  of  the  individual.  First, 
a  person  may  suddenly  or  chronically  function  at  a  level  of  performance 
below  the  average  for  most  people.    This  can  happen  because  of  an  acute 
or  chronic  medical  condition  such  as  epilepsy,  diabetes,  heart  disease, 
mental  illness,  or  senility,  or  because  a  person  is  temporarily  under 
the  effects  of  a  drug  like  alcohol  or  carbon  monoxide  or  is  extremely 
young. 

There  is  also  some  documentation  that  lower  performance  may  occur 
during  the  premenstrual  and  menstrual  parts  of  the  normal  menstrual  cycle, 
and  conceivably  during  some  hours  of  circadian  cycles .  Inexperience 
with  the  particular  task,  or  certain  social  or  societal  conditions  and 
pressures  may  also  lead  a  person  to  function  at  less  than  usual  performance 
level,  an  exan^le  being    the  driving  behavior  of  a  teenager  in  the  presence 
of  peers. 

Another  way  in  which  demand  may  exceed  performance  is  because  the 
task  either  is  continuously  difficult  or  has  suddenly  and  temporarily 
become  substantially  more  demanding.    This  may  happen  for  various  reasons, 
some  common  and  some  unique.    As  the  task  increases  in  demand  the  performance 
level  of  the  person  also  increases  somewhat,  but  often  not  enough  to 
prevent  demands  from  exceeding  performance  at  least  on  occasion.  The 
change  on  the  part  of  the  person  represents  utilization  of  some  of  his 
or  her  spare  capacity  until  maximum  performance  level  is  reached  in  order 
to  attempt  to  avoid  what  has  been  perceived  by  the  person  to  be  an  impending 
disaster  as  the  task  gets  increasingly  out  of  control.    Spare  capacity 
refers  to  the  level  of  performance  a  person  is  potentially  able  to  produce 
at  any  given  moment  in  order  to  prevent  task  demand  from  exceeding  perfoimance 
level . 

We  are  now  ready  to  examine  the  third  type  of  failure  situation, 
one  that  is  commonly  overlooked  because  people  tend  to  think  only  of 
human  failure  or  task  overload.    In  this  case  both  the  person  and  the 
task  contribute  to  the  event.    The  person  may  be  temporarily  or  consistently 
functioning  at  somewhat  less  than  average  level  at  the  same  time  that 
the  task  is  tenporarily  or  consistently  somewhat  more  than  usually  demanding. 
Thus,  because  of  joint  contribution  the  two  lines  are  close  together 
and  have  significantly  greater  than  average  likelihood  of  crossing. 


35 


Why  is  this  sort  of  relationship  so  often  overlooked  when  it  may 
in  fact  be  the  most  frequent  mechanism  in  the  initiation  of  injury  events? 
There  are  probably  two  reasonable  explanations.    First,  most  of  us  are 
taught  from  grade  school  on  to  oversimplify  explanations  of  causation. 
Thus ,  we  are  more  likely  to  be  trained  for  and  attuned  to  seeking  single 
causal  factors  than  to  identify  and  tease  out  more  complex  etiologies, 
perhaps  involving  several  conditions  acting  simultaneously. 

Probably  equally  important,  many  of  the  relative  increases  in  task 
demand  are  so  common  and  so  subtle  that  most  of  us  respond  to  them  subcon- 
sciously, and  we  do  not  realize  that  it  is  only  because  we  usually  have 
sufficient  capability  to  maintain  a  fair  degree  of  spare  capacity  that 
we  are  able  to  effectively  deal  with  sudden  and  sometimes  unnecessary 
increases  in  task  load  without  disaster. 

Given  the  information  about  the  interactions  of  humans  and  tasks 
in  the  pre-injury  phase,  it  should  be  possible  to  combine  the  examples 
of  varying  human  capabilities  and  different  task  demands,  and  spare  capacity 
into  a  single  diagram.    This  has  been  done  in  the  figure  which  shows 
that  as  the  task  gets  more  demanding,  it  (a)  reaches  a  point  at  which 
it  is  beyond  the  capability  of  the  least  competent  (with  respect  to  that 
task)  members  of  society,  and  (b)  reduces  the  amount  of  spare  capacity 
that  more  competent  members  may  have  remaining  at  any  given  moment  so 
that  they  can  avert  disaster  if  there  is  a  sudden  further  increase  in 
task  demand,  a  sudden  decrease  in  their  own  performance,  or  both. 

Let  us  assume,  as  shown  in  this  figure,  that  a  point  has  been  reached 
at  which  task  demand  exceeds  performance  level  and  the  real  or  potential 
energy  that  is  being  managed  is  now  no  longer  under  control.    At  that 
moment  the  pre-injury  phase  has  been  ended  and  the  injury  phase  of  the 
event  begins . 

The  Injury  Phase 

The  fact  that  energy  is  out  of  control  does  not  in  and  of  itself 
mean  that  an  injury  must  necessarily  occur.    Several  intervening  conditions 
determine  whether  injury  will  occur  and  how  severe  it  will  be.    The  basic 
principles  are  the  following: 

1.  The  greater  the  mass  of  energy  that  exists  and  is  released, 
and  the  more  rapid  the  release,  the  greater  the  likelihood  that  injury 
will  occur  and  that  it  will  be  severe. 

2.  If  the  energy  reaches  tissue,  the  rate  of  the  transfer  (ideally 
described  in  units  of  energy  per  unit  of  body  tissue  per  unit  of  time) 
determines  the  severity  of  injury. 

3.  Severity  is  also  determined  by  inherent  characteristics  of  the 
tissue  itself  and  of  the  organism. 
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An  Alternative  Pathway 


Although  all  unintentional  injury  involves  damage  by  misapplication 
o£  physical  energy  some  such  events  occur  through  a  mechanism  other  than 
the  unintentional  transfer  of  energy  from  an  external  source  to  the  person. 
The  body  carries  out  its  own  internal  mechanisms  for  energy  management 
that  permits  us  to  maintain  a  balance  or  homeostasis  with  the  environment. 
An  event  that  interferes  with  this  homeostasis  can  also  cause  harm  through 
energy  misapplication.    Examples  include  drowning,  some  types  of  poisoning, 
and  exposure  to  extreme  cold. 

Post  Injury  Phase 

One  further  generic  factor  determines  the  ultimate  outcome  of  injury. 
This  is  the  entire  series  of  actions  that  occur  after  the  injury  and 
which  may  result  at  one  extreme  in  early  rehabilitation  without  permanent 
harm,  or  at  the  other  extreme  in  either  death  or  continuing  disability. 
Data  suggest  for  example  that  somewhere  between  15-25%  of  persons  viho 
die  from  highway  crashes  might  still  be  alive  if  emergency  care  were 
more  readily  available  and  of  better  quality. 

Innocent  -  and  not  so  innocent  -  Bystanders 

One  of  the  questions  that  is  sometimes  raised  by  people  ^fAlo  consider 
the  energy  management  model  just  described  is  whether  it  takes  into  account 
the  apparently  common  occurrence  in  which  an  innocent  bystander  is  injured. 
The  answer  is  yes .    We  need  to  consider  two  types  of  situations ,  that 
in  which  the  individual  who  is  injured  clearly  is  an  inadvertent  victim, 
and  that  in  which  he  or  she  only  appears  to  be  so. 

The  model  presented  indicates  that  if  an  energy  management  task 
is  greater  than  the  individual's  capability  of  dealing  with  it  the  energy 
may  go  out  of  control.    From  that  point  on  the  errant  energy  may  be  available 
to  injure  the  person  who  was  originally  handling  it,  or  it  may  create 
damage  to  any  other  people  or  structures  that  happen  to  be  in  the  immediate 
vicinity.  Thus,  the  driver  of  a  bus  or  pilot  of  a  plane  who  loses  control 
of  the  vehicle  may  take  with  him  not  only  his  passengers  but,  especially 
in  urban  areas,  many  others  who  are  only  circumstantially  associated. 

Can  this  be  described  as  a  random  event?    It  can  only  in  a  very 
narrow  sense.    One  may  not  be  able  to  predict  which  particular  innocent 
bystander  is  likely  to  be  injured.    But  it  may  be  possible  to  prognosticate 
fairly  accurately  how  many  such  persons,  of  what  types,  and  under  what 
conditions.    Socioeconomic,  cultural,  and  legal  circumstances,  for  example, 
determine  the  degree  of  crowding  that  may  exist  in  an  apartment  house , 
or  on  a  bus,  and  the  likelihood  that  the  particular  bus  or  building  meets 
specific  safety  codes.    Federal,  state,  or  local  standards  may  dictate 
whether  a  plane,  or  a  truck  with  high  energy  explosives,  is  permitted 
to  travel  through  areas  that  are  heavily  populated  or  whether  precautions 
have  been  taken  so  that  even  if  the  energy  is  out  of  control  it  will 
damage  relatively  few  unsuspecting  persons. 
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Let  us  now  look  at  the  not  so  innocent  bystanders.  Surprisingly, 
there  are  more  of  these  than  is  commonly  thought.    One  group  of  not  so 
innocent  bystanders  is  easily  identified- -people  who  stand  around  and 
observe  arguments,  fights,  fires,  and  other  disasters  and  who  consciously 
run  the  risk  of  being  drawn  into  a  potential  chain  of  damaging  events. 

Another  group  is  individuals  who  are  seriously  or  fatally  injured 
as  passengers  of  drivers  impaired  by  alcohol.    There  is  now  strong  evidence 
that  such  persons  as  a  rule  also  have  been  drinking  and  usually  are  as 
impaired  as  is  the  driver  of  the  vehicle.^ 

What  about  people  who  are  lost  in  ravages  of  floods,  tornadoes, 
earthquakes ,  or  volcanoes?    Surely  they  must  be  innocent  victims .  Information 
suggests  that  in  fact  this  may  not  be  the  case.    One  is  the  long  history, 
going  back  into  antiquity,  of  rebuilding  homes  and  even  entire  cities 
at  the  same  location  where  previous  ones  were  just  destroyed  by  "natural 
events"  with  high  probability  of  reoccurring.    Furthermore,  such  redevelopment 
may  use  precisely  the  same  methods  of  construction  that  were  shorn  to 
be  noneffective  in  the  past.    Finally,  in  contrast  to  this  ignoring  of 
long-term  warnings,  there  is  the  deaf  ear  turned  to  notices  of  immediate 
danger. 

Thus,  in  the  presence  of  natural  massings  of  potentially  destructive 
energy,  people  through  all  of  the  methods  described  above  do  not  function 
in  a  manner  most  conducive  to  keeping  the  energy  within  some  modicum 
of  control,  i.e,  in  a  way  that  will  limit  its  harmful  effects  on  them. 
Such  individuals  cannot  be  called  innocent  bystanders.    (It  must  be  emphasized 
that  this  statement  is  not  as  pejorative  as  it  appears  on  first  reading. 
Although  persons  who  ignore  warnings  about  imminent  disasters  may  be 
acting  foolishly,  those  who  build  or  rebuild  in  known  hazardous  locations 
or  ways  may  be  doing  so  because  they  personally  have  no  other  options 
because  of  shortages  of  land,  money,  etc.    The  "blame"  for  such  persons 
being  at  greater  risk  may  rest  with  the  community  or  society  rather  than 
with  the  individuals. 

IV.    A  ]ybdel  for  Count ermeasures  Against  Injury 

Before  describing  the  range  of  options  for  reduction  of  injury  and 
its  outcomes ,  we  need  to  examine  first  some  important  questions  concerning 
relationships  between  what  is  known  about  the  mechanisms  of  injury  events, 
and  what  actions  may  be  appropriate  to  reduce  the  frequency  and  severity 
of  injury.    Appropriate  countermeasures  to  a  specific  type  of  problem- - 
whether  it  be  injury  or  illness--can  be  derived  logically  from  what  is 
known  about  the  natural  history  of  the  event  and  its  circumstances. 
But,  contrary  to  common  opinion,  they  do  not  necessarily  flow  obviously 
from  such  knowledge. 

The  difference  between  obvious  and  logical  is  that  an  obvious  solution 
is  one  suggested  primarily  by  examining  relative  frequencies  of  different 
factors  in  injury  events  and  by  attacking  first  the  factors  with  highest 
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frequency.    A  logical  solution  on  the  other  hand  is  one  that  may  include 
information  about  frequency  as  one  of  its  considerations  but  that  is 
suggested  primarily  by  examining  the  relative  feasibility  of  countermeasures 
for  affecting  ultimate  outcome  of  death,  disability,  and  discomfort  and 
for  having  limited  unwanted  side  effects  such  as  excessive  economic  or 
social  costs.  Occasionally,  an  obvious  solution  is  also  a  logical  solution. 

The  ideal  logical  solution  to  a  health  problem  is  one  that  can  be 
applied  universally  and  that  works  with  a  very  high  degree  of  effectiveness 
once  applied.    Such  ideal  solutions  often  do  not  exist,  however,  and 
one  may  have  to  be  content  with  logical  solutions  that  are  applicable 
to  helping  all  people  only  under  more  limited  circumstances  or  to  fewer 
people  over  a  wider  range  of  events.    The  appropriate  approach  in  this 
case  to  dealing  with  a  particular  type  of  injury  or  other  health  problem 
would  be  to  put  together  a  network  of  somewhat  overlapping  logical  solutions 
that  have  high  effectiveness  for  limited  situations  or  limited  but  acceptable 
degrees  of  effectiveness  for  wider  situations  so  that  in  combination 
these  partial  solutions  can  bring  about  substantial  reduction  in  injury 
frequency  and  severity. 

The  model  for  injury  control^  developed  by  Dr.  William  Haddon  starts 
with  the  concept  of  physical  energy  as  the  agent  in  injury  events  and 
asks  in  progressive  order  with  relation  to  the  previous  model  what  methods 
exist  for  limiting  the  harmful  effects  of  that  energy  on  people  and  property. 
Here  is  his  list  of  logical  solutions. 

1.  Prevent  the  initial  marshalling  of  the  form  of  energy. 

2.  Reduce  the  amount  of  energy  marshalled. 

3.  Prevent  the  release  of  energy. 

4.  Modify  the  rate  or  spacial  distribution  of  release  of  energy 
from  its  source. 

5.  Separate  in  space  or  time  the  energy  being  released  from  the 
susceptible  structure. 

6.  Separate  the  energy  being  released  from  the  susceptible  structures 
by  interposition  of  a  material  barrier. 

7.  Modify  the  contact  surface,  subsurface,  or  basic  structure  which 
can  be  impacted. 

8.  Strengthen  the  living  or  nonliving  structure  which  might  be 
damaged  by  the  energy  transfer. 

9.  Move  rapidly  in  detection  and  evaluation  of  damage  and  counter 
its  continuation  and  extension. 

10.    Carry  out  all  those  measures  which  fall  between  the  emergency 
period  following  damaging  energy  exchange  and  the  final  stabilization 
of  the  process  (including  intermediate  and  long-term  reparative  and 
rehabilitative  measures) . 

40 


This  series  of  options  is  both  unique  and  interesting  because  it 
places  the  anphasis  on  dealing  with  the  energy  at  all  stages  that  lead 
to  and  can  affect  ultimate  outcome  instead  of  eraphasing  primarily  how 
humans  can  be  modified,  and  particularly  doing  so  in  the  pre- injury  phase, 
as  has  been  the  most  common  approach  for  many  years.    Changing  people 
is  not  excluded  per  se  in  this  series ;  it  is  one  of  the  possible  methods 
available  to  prevent  the  release  of  energy.    Reducing  task  demand  is 
another  method  appropriate  here. 

only  problem- -and  it  is  a  minor  one- -with  the  Haddon  model  is 
ray  belief  that  especially  within  the  third  option  alone  there  exist  many 
potential  count ermeasures  whose  details  could  be  spelled  out  more  explicitly. 
Human  performance,  for  example,  can  be  maintained  at  satisfactory  level 
for  specific  tasks  at  least  theoretically  by  the  following  means: 

a)  Limit  exposure  to  certain  tasks  either  voluntarily  or  legally 
only  to  individuals  who  are  capable  of  performing  them. 

b)  Educate  people  so  that  they  have  requisite  knowledge  about  the 
nature  of  task  demands  and  knowledge  and  skills  so  they  are  able  to  deal 
with  these  demands. 

c)  Manipulate  those    attitudes  and  behaviors  of  people  that  may 

be  amenable  to  conscious  control  through  a  combination  of  education  about 
reasons  for  appropriate  attitudes  and  behavior,  peer  pressure,  and  laws 
and  regulations. 

Turning  to  task  demands ,  these  can  be  altered  in  the  following  manners : 

a)  Simplify  the  task  so  it  puts  less  of  a  burden  on  single  senses 
and  permits  one  to  assess  the  same  information  with  equal  effectiveness 
using  other  sensory  routes. 

b)  Simplify  the  task  so  it  requires  less  intelligence,  learning 
or  memory. 

c)  Simplify  the  task  by  making  cues  more  easily  visible,  legible, 
and  less  subject  to  visual  confusion. 

d)  Simplify  the  task  by  not  requiring  simultaneous  attention  to 
two  or  more  cues. 

e)  Simplify  the  task  by  neither  providing  stimuli  so  quickly  that 
the  individual  cannot  respond  to  all  within  the  time  available  (as  may 
occur  in  rush  hour  traffic)  nor  so  slowly  that  the  individual  becomes 
bored  and  is  unable  to  concentrate  on  that  task. 

f)  Simplify  the  task  by  not  putting  controls  of  similar  design 
so  close  together  that  they  may  be  confused. 
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g)  Sinplify  the  task  so  it  is  not  possible  to  turn  on  a  piece  of 
equipment  inadvertently  while  part  of  the  body  is  near  a  portion  of  the 
equipment  that  can  create  harm. 

h)  Reduce  task  demand  by  not  leaving  out  important  information 

that  the  individual  needs  in  order  to  assess  the  environment.    This  concept 
includes  a  sufficient  repetition  of  information  so  that  it  is  not  lost 
entirely  if,  for  whatever  reason,  it  is  overlooked  the  first  time  it 
is  available. 

i)  Reduce  physical  demands  of  the  task  by  decreasing  the  amount 
of  strength,  speed,  stamina,  balance,  or  range  of  motion  required. 

j)    Finally,  make  the  task  so  demanding  that  persons  not  competent 
to  perform  it  well  will  be  unable  even  to  start  the  activity  and  thus 
by  physical  means  will  be  protected  from  having  any  exposure  to  the  hazard. 

These  ideas  I'm  sure  are  quite  familiar  to  those  who  specialize 
in  human  factors  engineering. 

V.    Comments  About  Past  and  Current  Research 

Several  important  limitations  exist  concerning  injury  research  as 
it  has  been  and  is  now  being  carried  out.    First,  as  already  noted,  research 
about  the  process  by  which  ideas  and  data  are  converted  to  action  programs 
is  almost  entirely  absent. 

Second,  regarding  another  issue  already  alluded  to,  very  few  studies 
have  sought  to  examine  a  range  of  potential  contributory  factors  simultaneously 
in  a  manner  that  would  permit  observation  and  assessment  of  interactions. 
Even  where  such  examination  has  occurred,  as  in  the  multidisciplinary 
accident  investigation  program  of  the  National  Highway  Traffic  Safety 
Administration,  the  emphasis  has  been  on  more  obvious  types  of  failures 
or  problems ,  whether  involving  humans  or  the  product/environmental  complex. 
Studies  to  explore  more  subtle  interactions ,  such  as  shown  in  the  figure , 
just  don't  exist  in  the  multidisciplinary- endeavors .    I  do  not  know  if 
this  absence  is  because  few  people  are  aware  of  the  concept  or  because 
the  technology  for  teasing  out  the  subtle  is  felt  as  yet  to  be  too  much 
in  its  infancy. 

This  absence  of  such  studies  is  especially  surprising  since  several 
laboratory  type  efforts  for  the  Department  of  Transportation  suggest 
that  there  is  potential  pay  dirt  in  combining  human  factors  and  epidemiology. 
Such  combined  methods  could  determine  to  what  extent  and  under  what  circum-  i 
stances  theoretical  problems  identified  through  laboratory  studies  actually 
result  in  real  world  problems. 

In  illustration,  studies  for  DOT  indicate  that  drivers  in  several 
late  model  American  made  automobiles  have  only  about  40-70%  of  possible 
maximum  visibility  available  to  thern^,  and  that  in  most  automobiles  manufacture 
in  the  early  1970 's  drivers  in  the  top  and  bottom  20%  of  size  have  difficulty 
in  seeing  or  reaching  all  control  devices  when  wearing  seatbelt  and  shoulder 
harness."    Consumer  Advisory  Booklets  just  issued  by  NHTSA  show  that 
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the  braking  performance  to  get  a  car  from  60  to  0  raph  for  1976  car  models 
ranges  from  159  to  250  feet.^    For  1976  tires  placed  on  a  fully  loaded 
car  the  reserve  capacity  ranges  from  01  to  25^.^    So  what?!    It's  about 
time  we  knew  what  this  means  in  real  world  crash  experience.    One  report 
about  crashes  of  large  trucks  suggests  that  as  many  as  900,000  such  events 
annually  may  be  attributable  at  least  in  part  to  limitations  inherent 
in  the  design  of  current  rear  view  mirrors  and  other  problems  of  limited 
vision  on  these  vehicles. ^0 

Turning  to  product  safety,  ceramic  top  stoves  are  now  made  with 
burners  that  do  not  change  color  when  they  get  hot.    Theoretically,  this 
subtle  increase  in  task  demand  represents  a  problem  for,  among  others, 
the  person  who  lias  reduced  vision  and  heat  sensation  because  of  aging, 
or  the  person  who  is  distracted.    But  what  does  it  mean  in  terms  of  real 
events?    I  ask  that  question  only  academically  as  a  epidemiologist. 
As  an  administrator  concerned  with  injury  control  I  have  very  strong 
feelings  that,  given  the  information  that  already  exists  about  the  behavior 
of  children  and  of  housewives  under  pressure,  and  the  physiology  of  aging, 
manufacturers  should  have  had  more  sense  and  more  sense  of  responsibility 
than  to  market  such  a  potential  hazard  in  the  first  place. 

Third,  attention  should  be  directed  to  cultural  contributors  to 
injury  events.    I  refer  here  to  two  different  phenomena.    One  of  these 
is  the  fact  that  when  a  new  product  or  pattern  of  functioning  is  introduced 
into  a  culture  it  often  appears  to  be  associated  initially  with  a  very 
high  injury  rate  during  a  learning  period.    Some  of  this  may  be  because 
the  product  itself  commonly  is  still  in  prototype  state  with  important 
hazardous  bugs  to  be  worked  out.    This  seons  to  be  the  case,  for  instance, 
with  the  snowmobile.il 

But  an  important  part  of  the  problem  also  appears  to  be  absolute 
or  relative  ignorance  by  users  and  others  exposed  about  rules  of  use 
and  potential  hazards.    A  good  example  is  the  pattern  of  problems  associated 
with  the  introduction  of  the  automobile  to  the  United  States  75  years 
ago  and  to  many  of  the  so-called  developing  nations  now.    A  paper  about 
traffic  problems  in  Sudan^^  presented  in  1975  documented  that  even  such 
simple  rules  as  on  which  side  of  a  traffic  island  one  should  drive  may 
be  nonexistent  in  some  places  where  there  a^e  still  very  few  cars.  Education 
probably  is  useful  during  this  early  phase.    But,  because  it  is  useful 
early  we  tend  to  think  it  is  still  just  as  useful  after  the  passage  of 
years;  and  this  assumption  may  not  be  correct. 

The  other  cultural  phenomenon  is  that  different  populations  vary 
in  what  is  expected  or  permissable  regarding  acting  out,  relating  to 
each  other  and  relating  to  the  surrounding  environment.    This  means  that 
there  may  be  important  cultural  variations  in  the  frequency  and  causation 
of  injury  events,  in  seeking  of  care  once  such  events  occur,  and  in  the 
potential  success  of  specific  countermeasures .    By  and  large,  this  aspect 
of  injury  and  injury  control  has  not  been  explored  because  few  sociologists 
have  been  interested  in  injury  as  an  area  for  research,  although  recent 
conference  proceedings  edited  by  Dr.  Alphonse  Chapanis  represent  an  important 
entree  of  human  factors  specialists  into  this  field. 1^ 
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Fourth,  some  very  rare  but  exceedingly  catastrophic  forms  of  injury 
events  now  are  on  the  verge  of  becoming  predictable,  and  research  about 
responses  to  such  predictions  is  warranted.    I  refer  to  the  fact  that 
it  is  now  possible  to  warn  people  about  iraminent  tornadoes  and  tidal 
waves,  and  that  similar  capability  almost  exists  for  avalanches  and  earthquakes 
One  study  suggested  that  observable  differences  in  death  rates  from  tornadoes 
in  northern  and  southern  United  States  may  be  largely  attributable  to 
differences  in  resident  responses  to  warnings. -'-^    Since  the  capability 
to  predict  and  to  warn  is  likely  to  precede  the  capability  to  prevent 
by  several  years  at  least,  we  had  better  have  some  rather  good  information 
about  what  available  countemeasures  are  likely  to  produce. 

Finally,  one  of  the  inportant  problems  of  dealing  with  real  world 
phenomena,  usually  after  the  fact,  is  that  the  quality  of  data,  especially 
those  collected  through  official  sources,  can  only  be  described  as  generally 
execrable   whether  one  refers  to  information  about  the  extent  or  nature 
of  populations  at  risk,  frequency  of  injury  events,  severity,  causation, 
or  countermeasures .    In  illustration,  one  research  group  reported  that 
61%  of  the  motorcycle  crashes  resulting  in  treated  injuries  or  death 
that  they  found  were  not  listed  in  the  official  police  statistics .^^ 
Another  study  identified  668  contributory  factors  among  104  randomly 
selected  motor  vehicle  crashes  in  lowa.^^    Fifty  percent  of  these  factors 
were  reported  to  be  vehicle  related,  31%  involved  the  environment,  and 
19%  the  driver. 

According  to  the  author  of  the  study,  "the  results  of  this  investigation 
appear  to  contradict  the  prevalent  concept  that  85%  of  all  motor  vehicle 
accidents  are  due  to  driver  malfunction.    This  concept  results  from  a 
rather  consistent  reporting  on  the  part  of  the  National  Safety  Council. 
If  the  sources  of  information  are  examined,  the  apparent  contradiction 
is  understandable.  Individual  states  report  their  yearly  traffic  accident 
experience  to  the  National  Safety  Council  on  a  standard  fom.    This  form 
allows  for  12  contributing  circumstances  to  motor  vehicle  accidents. 
Two  relate  to  the  vehicle,  and  the  other  10  relate  to  the  driver.  There 
are  no  roadway  circumstances  allowed. 

If  the  results  of  this  investigation  were  to  be  reported  within 
the  confines  of  the  standard  summary  form,  the  total  number  of  contributory 
factors  in  the  104  accidents  would  have  been  reduced  from  668  to  140, 
and  125  would  be  driver  related.    Within  the  context  of  the  source  material 
available  to  the  National  Safety  Council,  this  sampling  of  accidents 
would  be  analyzed  to  indicate  89%  of  the  contributing  circumstances  were 
driver  related.    The  majority  of  the  contributory  factors  could  not  be 
tabulated." 

Lack  of  awareness  of  this  problem  is  especially  important  because 
it  shapes  everything  from  the  initial  hypotheses  to  the  end  results  of 
the  many  researchers  who  only  incidentally  do  research  about  injury  instead 
of  engaging  in  such  activity  seriously  over  several  years .    Such  persons 
commonly  do  not  stay  long  enough  to  learn  about  and  avoid  the  pitfalls 
of  the  data.  To  paraphrase  Dante,  "all  hope  of  valid  data  abandon,  ye 
who  enter  here".  But  drawing  also  from  a  recent  short  story  by  Isaac 
Bashevis  Singer, 18  even  in  hell  one  can  continue  to  strive  for  improvanent . 
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NEEDED  HUMAN  RESEARCH  AND  NEW  METHODOLOGICAL 
CONSIDERATIONS  BEING  FORCED  BY  THE  LAW 


George  A.  Peters,  Esq. 

GEORGE  A.  PETERS  is  both  a  lawyer  and  an 
engineer  who  has  long  been  active  in  human  factors. 
As  a  lawyer,  he  has  limited  his  practice  to  product 
liability  litigation,  retaining  an  active  interest 
in  engineering  as  it  relates  to  the  law.    Mr.  Peters 
is  the  author  of  the  book  Product  Liability  and 
Safety  (Coiner  Publications,  1971)  and  many  articles 
m  law  journals. 

Peters '  presentation  to  the  workshop  is  based 
on  the  premise  that  it  is  the  common  law  which 
provides  the  major  forcing  function  in  safety 
endeavors  today.    It  is  in  the  courts  that  "...  the 
vital  safety  issues  and  concepts  are  framed,  final 
factual  decisions  are  rendered..."    Peters  contends 
that  it  is  time,  past  time  really  "...  for  the 
professionals  to  get  more  involved  in  these  safety 
issues ,  so  that  valid  information  will  be  available 
to  the  courts,  and  to  those  whose  efforts  could 
prevent  the  injuries  that  give  rise  to  law  suits." 

Most  human  behavioral  research  has  been  narrowed  by  experimental 
hypotheses  and  procedure  shaped  by  our  academic  training,  peer  review  systems, 
images  of  laboratory  controls  and  physical  science  models,  and  conceptual 
theories  evolved  from  age  old  philosophical  issues.  The  scope  of  such 
research  has  been  limited,  not  only  by  the  nature  of  self -generated 
hypotheses  in  truly  independent  research  situations,  but  also  by  restrictions 
implicit  in  contract  research  and  industrial  research  organizations.  Now, 
nothing  is  wrong  with  this,  except  that  the  narrowing  process  may  have  so 
narrowed  our  field  of  view  that  we've  failed  to  perceive  many  excellent 
research  opportunities.    This  is  particularly  true  in  the  field  of  safety 
where  opportunities  abound  for  the  talents  of  the  research  scientist,  and  the 
results  could  serve  to  reduce  the  human  carnage  from  an  undisciplined  modern 
technology . 

Because  personal  safety  is  a  primary  societal  concern  and  preventable 
injuries  still  occur  with  staggering  regularity,  our  system  of  law  has 
gradually  changed  and  has  created  forces  that  might  tend  to  correct  this 
socially  intolerable  situation.    The  cost  of  the  human  life  or  limb  has  been 
rapidly  escalated,  under  the  law,  so  that  there  is  greater  incentive  to 
perform,  subsidize,  or  apply  human  research.    The  courts  are  becoming 
increasingly  specific  in  delineating  safety  responsibilities  and  safety 
requirements  for  those  having  some  control  for  unsafe  conditions  or  unsafe 
acts .    Thus ,  the  increasingly  important  areas  of  safety  research  are  those 
being  formulated  by  the  courts,  rather  than  the  more  traditional  kinds  of 
hypotheses  that  might  be  generated  by  independent  research  scientists  or 
those  performing  under  contract  obligations. 
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The  laws  that  should  be  of  vital  concern  are  not  those  legislative 
statutes  that  create  governmental  agencies  empowered  to  issue  rules  and 
regulations  relating  to  safety.    This  may  be  a  highly  visible  enterprise 
but  it  has  little  to  do  with  the  vast  bulk  of  safety  law  or  the  concerns 
of  the  professional  safety  specialist.    It  is  the  common  law,  or  judge 
created  law,  that  is  being  applied  each  day  to  tens  of  thousands  of 
individual  lawsuits  in  the  local  county,  parish,  or  district  courtroom 
that  is  the  major  shape  force  today.    This  is  where  the  vital  safety 
issues  and  concepts  are  framed,  final  factual  decisions  are  rendered,  and 
millions  of  dollars  are  awarded  on  the  basis  of  safety  related  conclusions. 
It  is  where  the  answers  are  sought  to  a  wide  variety  of  safety  issues  that 
could  have  been  the  subject  of  legitimate  human  safety  research,  or  human 
behavioral  research,  but  where  such  answers  are  frequently  given  only  by 
those  who  can  speculate  or  extrapolate  from  information  that  has  not  been 
founded  on  any  experimentally  verified  data.    It  is  time  for  the  professionals 
to  get  more  involved  in  these  safety  issues,  so  that  valid  information  will 
be  available  to  the  courts ,  and  to  those  whose  efforts  coiiLd  prevent  the 
injuries  that  give  rise  to  lawsuits. 

Rare  Events 

As  to  liability  for  rare  events,  let  us  consider  the  design  of  a  toilet 
paper  dispenser.    What  type  of  human  behavior  with  a  toilet  roll  might  cause 
injury  for  which  the  household  or  premises  owner  might  be  legally  at  fault 
and  financially  liable?    What  would  be  the  range  of  foreseeable  or  predictable 
human  error?    One  example,  part  of  our  common  law  for  nearly  tm  decades, 
involved  a  case  where  a  woman  who  became  locked  in  a  lavatory,  saw  an 
opening  above  the  door  through  which  she  might  escape,  put  her  left  foot  on 
the  lavatory  seat,  grasped  with  her  left  hand  a  fixture  on  the  wall,  grabbed 
the  top  of  the  door  with  her  right  hand,  then  placed  her  right  foot  on 
the  toilet  roll  and  its  dispenser.    She  then  decided  that  it  would  be  too 
acrobatic  to  climb  over  the  door,  so  she  started  to  return  to  her  original 
position,  but  somehow  shifted  her  weight  on  the  toilet  roll  and  it 
rotated  causing  her  to  lose  her  balance  and  fall  to  the  floor  where  she 
sustained  moderate  injuries.    The  Judge  stated  that  "She  must  be  taken 
as  having  acted  entirely  rationally,"  and  damages  against  the  householder 
were  allowed.  (Sayers  V.  Harlow  Union  District  Council,  2  All  E.  E.  342, 
England,  1958). 

Similarly,  when  a  landlord  failed  to  repair  the  water  pipes  to  an 
unf lushing  toilet,  after  a  fire,  damages  were  awarded  to  a  woman  who  injured 
her  back  pailing  water  from  the  bathtub  to  the  toilet  (Mitchell  V.  Friedman, 
11  N.  J.  S.  344,  78  A2d  417,  1951).    Thus,  pailing  water  to  an  unflushing 
toilet  or  standing  on  a  toilet  paper  roll  are,  legally,  not  such  rare 
events  or  remote  causes  as  to  deny  liability.    Therefore,  they  are  the 
classes  of  human  behavior  that  are  predictable,  about  which  data  should 
be  gathered  by  someone,  because  liability  or  fault  is  attached  to  the 
omission  of  such  considerations.    Now,  who  would  perform  such  research? 
I  don't  think  that  the  manufacturer  of  toilet  paper  rolls  would  think  it 
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within  his  province  and  the  manufacturer  of  dispensers  or  fixtures  might 
be  too  small  or  believe  that  this  is  a  systems ,  a  general  contractor ,  or 
an  architect's  problem.    So,  we  have  an  example  of  rare  event  research 
and  application  information  that's  just  not  rolling  along. 

The  design  and  layout  of  bathroom  products  is,  indeed,  medieval  and 
primitive,  rather  than  functional  and  adapted  to  the  range  of  anthropometric 
and  behavioral  variations  clearly  foreseeable.    That  the  bathroom  is  a 
major  source  of  home  injuries  is  rather  obvious.    But,  I  know  of  few 
human  factors  scientists  who  are  vocationally  preoccupied  with  this 
particular  area  of  research.    I  have  seen  bathrooms  expanded  in  scope  with 
more  space,  objects,  compartments,  utensils,  and  ornamentation  as  builders 
react  to  perceived  buyers'  tastes ... .but  this  merely  means  that  there  is 

an  expanding  variety  of  new  accident  conditions  being  built  into  home  

perhaps,  because  there  is  a  comparative  absence  of  research  findings 
relative  to  this  essential  area  of  our  life  space.    This  situation  may 
not  be  remedied  until  we  have  a  Piaget  of  the  bathroom  who  has  a 
Jacques  Cousteau  flair  for  dissemination  of  empirical  findings . 

Failure  to  Provide  Safety  Devices  Where  Human  Error  Foreseeable 

A  young  boy  put  his  arm  inside  a  launderette  washing  machine  after  it 
had  stopped  its  spin  cycle,  it  then  started  spinning  and  injured  the  boy's 
arm.    An  expert  testified  that  if  a  door  interlock  had  been  installed,  the 
machine  could  not  have  started  spinning  with  the  door  open,  and  the  injury 
would  not  have  occurred.    In  this  case,  the  appeals  court  stated  that 
there  was  evidence  sufficient  for  a  jury  to  find  a  design  defect  under 
strict  liability  against  the  launderette  owner  in  much  the  same  way  it 
could  against  the  manufacturer,  retailer,  or  leaser  (Garcia  v.  Halsett, 
3  Cal.  App.  3d  319,  82  Cal,  Rptr.  420,  1970).    This  case  extended  the 
manufacturer's  liability  for  negligence  in  failing  to  adopt  and  provide 
reasonable  safety  devices  (Varas  v.  Barco  Mfg.  Co.,  205  Cal.  App.  2d  245, 
22  Cal.  Rptr.  737,  1962)  to  strict  liability  for  failure  to  provide 
safety  devices  such  as  interlocks.    Obviously,  such  interlocks  must  not 
themselves  be  unreasonably  susceptable  to  a  fail  unsafe  mode,  a 
malfunction  associated  with  a  foreseeable  misuse,  or  an  intentional 
suppression  of  function. 

Failure  to  Compensate  for  Human  Clumsiness 

A  coffeepot  shattered  and  flying  glass  struck  and  injured  the  consumer. 
It  was  alleged  that  the  user  had  accidentally  bunded  it  against  a  faucet 
while  filling  it  with  water,  that  this  may  have  cracked  it  and  ultimately 
caused  it  to  shatter  upon  heating.    The  court  decided  it  was  a  jury  question 
whether  the  coffeepot  was  defective,  given  an  insubstantial  bumping  during 
an  intended  and  foreseeable  use. 
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Failure  to  Provide  Auditory  Warning 


A  construction  worker  was  killed  when  a  front  end  loader  backed  over 
him  because  the  driver  could  not  see  the  worker,  who  stood  about  30  feet 
away,  due  to  a  blind  spot.    An  expert  testified  that  the  blind  zone  could 
have  been  reduced  by  mirrors  and  the  danger  also  reduced  by  an  audible 
backup  warning  (Pike  v.  Frank  C.  Hough  Coiipany,  2  Cal.  3d  465, 
85  Cal.  Rptr.  629,  467  p.  2d  229,  1970). 

Failure  to  Provide  Adequate  Vision 

A  young  child,  standing  in  front  of  a  bakery  truck,  could  not  be  seen 
by  the  truck  driver  who  started  forward  and  injured  the  child. 

The  bakery  truck  attracted  children  who  purchased  the  bakery  products 
being  sold  from  the  truck  and,  therefore,  the  truck  was  equipped  with  a 
mirror  so  that  the  driver  could  see  in  front  of  the  bumper.    However,  there 
was  still  a  blind  spot,  and  an  expert  testified  that  additional  mirrors 
would  have  prevented  the  accident  (Menchaea  v.  Helms  Bakeries,  Inc., 
68  Cal.  2d  535,  67  Cal.  Rptr.  775,  439  p.  2d  903,  1968). 

Label  Warnings 

In  1965  (in  Hubbard -Hall  Chemical  Co.  v.  Silverman  340  F.  2nd  402, 
1st  Cir.) ,  a  Federal  court  held  that  a  printed  warning  of  danger  was 
insufficient  on  an  insecticide  label,  that  skull  and  bones  or  similar 
pictoral  symbols  were  also  necessary  and,  for  the  failure  to  include  the 
pictoral  symbol,  the  manufacturer  could  be  held  liable  for  any  injuries, 
such  as  insecticide  poisoning,  proximately  caused  by  the  omission.  Why, 
because  it  was  foreseeable  or  predictable  that  farm  laborers  may  have 
limited  education  and  reading  ability.    Those  injured  were  Mexican- 
Americans  who  could  not  read  the  insecticide  label  because  it  was  printed 
in  English.    Incidently,  this  liability  attached  despite  the  fact  that 
under  the  Federal  Insecticide  Act  and  despite  the  fact  that  the 
United  States  Department  of  Agriculture  had  approved  the  label. 

This  underlines  the  well  known  fact  that  compliance  with  government 
standards  or  approval  by  government  agencies  is  no  more  assurance  of 
safety  than  compliance  with  voluntary  concensus  trade  standards  or 
approval  by  industry  supported  organizations  that  certify  or  endorse  a 
product's  safety.    Safety  standards  and  safety  certification  must  achieve 
quantum  jun^DS  in  validity.    However,  they  may  continue  to  be  accepted  as  bare 
minimums  for  safety  and  some  evidence  of  due  care,  but  only  in  negligence 
actions.    In  some  jurisdictions,  there  is  still  some  life  to  one  of  their 
original  purposes  in  aiding  attorneys  in  the  defense  of  lawsuits.  While 
still  a  viable  insurance  loss  control  measure,  safety  standards  today  are 
relatively  poor  and  very  costly  end-products  of  safety  research.  Open 
publication  of  original  research  findings ,  as  required  by  most  accepted 
codes  of  ethics  for  scientists,  remains  the  most  effective  means  of 
disseminating  scientific  information.    Open  publication  best  serves  the 
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ultimate  public  beneficiary,  who  (in  the  final  analysis)  actually  underwrites 
the  cost  of  research.    Contrast  this  with  the  restricted  transmission  of 
scientific  research  to  a  standards  formulation  process  that  is  intrinsically 
biased  by  its  concensus  compromise  procedures  and  the  self-interest  of  those 
who  are  typically  active  in  such  activities .    This  poses  a  moral  and  ethical 
obligation  that  far  too  many  scientists  have  overlooked  to  the  detriment 
of  the  vitality  of  safety  research  and  the  public  interest.    Research  performed 
in  support  of  a  standards  development  program,  if  separately  published, 
might  prove  of  greater  ultimate  value  than  the  standard  itself. 

Obviousness 

In  Luque  v.  McLean  (8  C.  3d  136,  104  Ca.  Rptr.  443,  501  P.  2d  1163, 
1972) ,  a  young  man  was  injured  when  he  slipped  on  wet  grass  and  his  hand 
entered  the  discharge  chute  of  a  rotary  power  motor.    The  jury  was  instructed 
that  there  could  be  no  liability  for  the  injuries,  if  the  young  man  had 
been  aware  of  the  defect  at  the  time  of  the  accident;  that  is,  a  distinc- 
tion was  drawn  between  obvious  as  contrasted  with  hidden  defects.  The 
California  Supreme  Court  repudiated  this  distinction,  so  the  safety  engi- 
neer must  pay  as  much  attention  to  obvious  hazards  as  he  does  to  hidden 
hazards.    Safety  research  should  not  depreciate  obvious  hazards. 

How  safe  is  safe? 

Back  in  1963  (in  Roberts  v.  United  States,  316  F.  2d  489,  3d  Cir.) , 
where  a  manufacturer  failed  to  place  any  warning  labels  on  containers  of 
ethylene  glycol,  a  Federal  court  held  "one  who  supplies  a  product... 
for  another  to  use  is  subject  to  liability  for  bodily  harm. . .if .. .from 
the  facts  known  to  him  should  realize  the  product... is  likely  to  be 
dangerous  for  use...  and  fails  to  exercise  reasonable  care  to  inform... of 
facts  and  conditions  which  make  the  product  likely  to  be  dangerous."  This 
is  known  as  "negligent  failure  to  warn"  and  employs  the  risk  criterion 
of  "dangerous ." 

Now,  even  in  strict  liability,  the  same  criterion  had  been  used, 
as  employed  in  the  Restatement  of  Torts,  second,  section  402  A,  in  the 
following  context:    "One  who  sells  any  product  in  a  defective  condition 
unreasonably  dangerous  to  the  user  or  consumer  or  to  this  property  is 
subject  to  liability  for  physical  harm  thereby  caused."    Now,  this  means 
that  a  product  could  be  reasonably  dangerous  and  no  legal  fault  would 
attach.    Thus,  product  safety  engineer  were  using  this  criterion  as  to 
whether  a  particular  risk  was  acceptable,  tolerable,  or  safe.    In  other 
words,  to  be  unsafe,  it  had  to  be  unreasonably  dangerous. 
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To  put  this  into  proper  context,  a  safety  engineer  searches  to  identify- 
all  hazards.    Then  he  determines  the  risk  associated  with  each  hazard.  The 
risk  analysis  is  but  a  prelude  to  a  determination  as  to  whether  the  risk 
is  acceptable  or  unacceptable;  this  decision -making  involves  a  personal 
value  judgement  as  to  whether  the  magnitude  of  the  risk  is  a  tolerable  risk 
or  of  such  a  magnitude  as  to  require  some  risk  reduction  action.    It  is 
that  value  judgement  that  is  the  essence  of  the  professional  practice 
of  safety  engineering,  since  each  decision  accepts  or  rejects  a  predictable 
amount  of  human  injury  and  property  damage. 

Certainly,  this  kind  of  decision-making  requires  some  understanding 
of  what  the  law  regards  as  a  safe  or  unsafe  product ,  process ,  act , 
condition,  or  system.    Guidance  is  not  found  in  the  cookbook  application 
of  design  requirements,  the  code  compliance  mentality  of  technicians, 
nor  from  jailhouse  lawyers  attempting  to  apply  the  letter  of  the  law  while 
failing  to  understand  its  spirit,  intent,  trend,  or  worse  case  implications. 

Ultimately,  it  could  be  a  jury  that  second-guesses  the  safety  engineer's 
original  decision  as  to  whether  a  hazard  constitutes  such  a  risk  that  is 
unsafe.    The  jury  does  this  as  a  first  step,  before  deciding  the  damages 
to  be  awarded  to  the  injured,  based  upon  the  words  contained  in  the  Judge's 
Instructions  to  the  Jury.    As  I  have  previously  mentioned,  the  words  used 
the  phrase  "unreasonably  dangerous,"  that  is,  that  risks  created  should  not 
be  unreasonably  dangerous . 

This  level  of  acceptable  risk  was  reduced  when  the  California 
Supreme  Court,  in  1972,  in  Cronin  v.  J.  B.  E.  Olson  Corp.,  8  Cal.  2d  121, 
104  Cal.  Rptr.  433,  501  P.  2d  1153  eliminated  the  term  "unreasonably 
dangerous"  and  substituted  the  term  "defect."    Thus,  the  jury  instruction 
and  the  criterion  used  by  the  product  safety  engineer  were  that  a 
defective  design  is  a  design  that  subjects  a  user  or  bystander  to  a 
"unreasonable  risk  of  harm"  from  the  reasonable  and  foreseeable  use  of 
a  product.    However,  on  March  23rd  1976,  a  California  Appeals  Court,  in 
Foglio  V.  Western  Auto  Supply,  56  C.  A.  3d  470,  another  lawn  mower  case, 
ruled  that  the  unreasonable  risk  of  harm  instruction  was  erroneous, 
prejudicial,  and  in  contravention  of  the  common  law  of  California.  Only 
the  term  "defect"  was  to  be  used.    Thus,  the  level  of  risk  that  can  be 
tolerated  has  and  is  being  lowered.    So  the  safety  engineer  must  have  a 
better  understanding  of  low  risk  and  rare  event  hazards,  a  broader 
understanding  of  design  alternatives,  less  reliance  on  customary  practices 
of  the  industry,  and  better  insight  into  what  those  sitting  on  juries 
would  believe  to  constitute  a  defect  and  unacceptable  risk.    Thus,  the 
law  is  changing  the  rules  of  the  game  for  safety  engineers,  and  those 
safety  engineers  who  understand  this  fact  of  life  have  a  new  blatant  thirst 
for  a  broad  range  of  safety  research  data,  analyses,  and  conclusions. 

Since  any  safety  engineer  must  expect,  sometime  during  his  professional 
career,  to  testify  in  court  proceedings,  he  should  also  have  some  understanding 
of  what  is  meant  by  such  terms  as  assumption  of  the  risk,  contributory 
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negligence,  and  conparative  negligence.    But,  for  assumption  o£  the 
risk,  do  we  have  very  much  research  that  will  help  us  really  define  what 
it  is  when  a  person  "voluntarily"  and  "unreasonably"  subjects  himself  to 
a  "known"  danger,  with  an  "appreciation"  of  the  "amount  of  danger?"  For 
contributory  negligence,  exactly  what  constitutes  a  failure  to  use 
"ordinaiy  care"  for  the  protection  of  one's  own  safety?    Do  we  understand 
why  some  people  continue  to  operate  or  use  a  product  after  "discovery" 
of  its  "defective  condition?"    Do  we  have  a  rationale  basis  for  allocating, 
in  percentages,  the  degree  of  "human  fault"  under  comparative  negligence 
determinations  now  being  made  by  juries?    The  behavioral  sciences  could 
contribute  a  great  deal  if  they  could  rigorously  explore,  carefully  define, 
and  illuminate  risk-taking  behavior  in  terms  and  circumstances  useful 
to  lawyers,  judges,  juries,  industrial  managers,  and  safety  engineers 
in  connection  with  the  "recognition"  and  "appreciation"  of  "danger,"  failure 
to  exercise  "proper  care"  for  personal  safety,  and  the  assumption  of  risk 
in  varying  situations  and  by  groups  varying  in  age,  intelligence, 
education ,  etc . 

This  is  a  worthy  field  of  endeavor  and  one  that  could  greatly 
influence  the  field  of  safety.    Worthwhile  results  would  command  the 
attention  of  a  widespread  group  of  people,  since  the  forcing  function  may 
be  the  very  economic  survival  of  otherwise  viable  industrial  and  commercial 
enterprises .    The  imperative  lies  in  our  future  generations ,  who  should  not 
be  needlessly  maimed  and  crippled  in  the  fashion  of  our  current  generations 
who  are  forced  to  work,  travel,  and  live  in  an  unconscionably  unsafe 
environment . 
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METHODS  FOR  STUDYING  COMPLEX  HOMEMAKING  TASKS 


Rose  E.  Steidl,  Ph.D 
Cornell  University 

ROSE  E.  STEIDL,  is  professor  and  chairman, 
Department  of  Design  and  Environmental  Analysis 
in  the  College  of  Human  Ecology  at  Cornell  University. 
Dr.  Steidl  has  long  been  involved  with  research 
on  household  tasks  and  the  design  of  home  work 
environments.    Her  work  is  reflected  in  numerous 
technical  and  consumer  oriented  publications. 
Among  these  is  the  book  Work  in  the  Home  (John  Wiley 
and  Sons,  1968,  co-authored  by  Ester  Crew  Brat t on) . 

Although  Steidl 's  work  has  not  been  directly 
concerned  with  accident  or  safety  research,  the 
methods  she  has  employed  and  discusses  in  the 
present  paper,  do  have  immediate  application 
to  such  research.  Of  particular  interest  is  the 
use  of  memo  motion  film  techniques  in  observational 
studies . 

Introduction 

Task  complexity  is  a  comparatively  unstudied  area  in  home  management 
in  relation  to  safety,  yet  information  about  complex  tasks  may  contribute 
to  accident  prevention.    In  this  paper,  I  include  some  information  about 
complex  tasks  and  present  two  methodological  approaches  \\rhich  have  been 
used  and  may  serve  as  a  bench  mark  for  further  work. 

Homemaking  work  is  an  ever  present  and  changing  problem.    Some  changes 
come  from  within  the  home- -from  the  homemaker  herself,  the  family,  the  tasks. 
Other  changes  come  from  outside  the  home- -the  goods  and  services  available, 
technological  developments  and  shortages,  the  community,  and  the  weather,  for 
instance. 

Even  though  homemaking  work  has  many  changing  aspects,  there  is  often  a 
certain  amount  of  sameness  that  leads  to  many  routines  and  almost  surface 
attention  while  doing  the  different  tasks.    The  worker's  mind  is  not 
completely  occupied,  but  not  free  enough  to  let  the  homemaking  task  become  the 
secondary  task  for  very  long. 

Homemaking  includes  many  tasks  with  contrasts  in  characteristics . 
Some  tasks  are  physically  demanding,  others  more  thought  demanding;  some 
are  judged  large,  others  small;  some  discontinuous,  others  continuous; 
some  liked,  others  disliked;  some  are  simple,  others  complex.    We  do  not 
know  enough  about  task  complexity.    For  example,  does  complexity  come  from 
within  each  task,  from  the  coordination  of  tasks  within  the  heme,  from 
the  coordination  of  tasks  between  the  home  and  outside  it ,  or  from  the 
context  within  which  the  tasks  are  done? 
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Some  of  our  data  suggest  that  one  source  of  complexity  is  from 
combining  and  fitting  tasks  together  (Steidl,  1975a).    Managing  a  home 
requires  coordinating  both  a  variety  of  activities  and  the  parts  of 
each  activity.    Many  tasks  encompass  time  and  location  variables; 
the  worker  controls  some  of  the  discontinuity  of  action,  and  events 
external  to  the  situation  may  affect  further  the  stops  and  starts. 
However,  some  of  the  intermittency  of  action  is  inlierent  in  the  nature 
of  the  task.    The  processing  may  continue  without  the  worker  being  present, 
thus  permitting  the  worker  to  change  to  another  activity  (Steidl,  1963a; 
Steidl  and  Bratton,  1968). 

Machine  washing  of  laundry  can  be  used  as  an  example  of  intermittency 
of  action  that  is  inherent  in  the  nature  of  the  task.    A  natural  division 
of  action  occurs  after  the  machine  is  loaded  and  the  washer  started. 
Washing  time  must  elapse  before  the  next  part  of  the  task  can  be  done, 
and  the  worker  need  not  be  present  during  that  time  interval .    In  meal 
preparation,  much  of  the  work  may  also  be  intermittent.    For  example, 
baked  potatoes  cannot  be  produced  by  one  continuous  action;  work  is 
necessarily  interrupted  while  the  potatoes  bake,    the  worker,  therefore, 
has  active  and  inactive  work  periods  for  the  job  of  baking  potatoes. 

This  characteristic  of  intermittent  action  on  a  task  is  not  unique 
to  homemaking  tasks,  and  it  is  not  a  particularly  difficult  concept  to 
comprehend.    What  is  probably  difficult  is  to  identify  all  of  the 
implications,  and  at  this  workshop,  to  consider  the  importance  for 
safety.    Both  the  amount  of  shifting  from  one  activity  to  another  and 
the  number  of  activities  being  carried  on  concurrently  may  be  closely 
related  to  fatigue,  to  attention  demands.    Other  considerations  are  the 
number  of  changes  of  location,  the  duration  of  action  in  the  various  work 
periods,  the  tasks  done  together,  and  the  order  of  doing  them. 

We  have  used  memomotion  film  records  of  meal  preparation  and  cleanup 
to  study  the  continuity  of  action  on  each  menu  item  or  "job"  and  the 
following  graphs*  provide  timing  and  changes  of  location  data  from  one 
set  of  case  studies  in  which  the  working  conditions  were  varied  but  the 
menu  remained  constant  (Steidl,  1957). 

Memomotion  film  analysis 

A  memomotion  film  is  a  motion  picture  film  exposed  at  less  frequent 
intervals  than  the  common  rate  of  16  frames  per  second  in  micromotion 
films.    Usually,  memomotion  films  are  made  at  the  rate  of  one  frame  per 
second,  but  occasionally  at  10  frames  per  second.    Each  frame  is  a  picture 
exposed  for  a  fraction  of  a  second.    This  technique  was  developed  almost 


*Ed.  note:  Graphs  and  other  figures  referenced  in  the  text  are  presented 
at  the  end  of  this  paper. 
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30  years  ago,  in  1947,  by  Dr.  Marvin  E.  Mindel,  an  industrial  engineer  at 
Purdue  University.    Mrs.  f^ry  Koll  Heiner  at  Cornell  University  recognized 
the  potential  for  studying  work  in  kitchens  and  we  adapted  the  technique 
to  our  purpose.    I  brought  several  films  with  me  and  will  use  them  to 
demonstrate  some  of  the  methods  of  analysis  and  characteristics  of  tasks. 
The  memomotion  films,  of  course,  do  not  provide  a  complete  record  since 
15  out  of  every  16  frames  of  the  film  are  missing.    The  action  is  jerky, 
like  the  old  Charlie  Chaplin  films,  rather  than  continuous  and  smooth. 
For  the  most  part,  the  missing  detail  has  not  been  a  problem.    Analysis  is 
easier,  however,  when  a  brief  written  record  is  made  concurrently  with  the 
film  record;  the  analyst  then  has  a  faster  and  less  tedious  job  of  recording 
data.    Whether  the  same  thing  is  true  with  the  more  sophisticated  recording 
systems  available  now  may  be  a  question  you  would  discuss  later. 

We  have  analyzed  memomotion  films  for  various  kinds  of  information: 

"to  determine  what  activity  was  being  done,  how  it  was  done,  what 
was  used,  who  was  doing  it,  who  else  was  present,  and  exactly  where  it  took 
place.    The  duration  of  the  activity  and  the  sequence  of  events  can  also 
be  determined. 

"Time  can  be  determined  most  directly  by  obtaining  a  count  of  the 
number  of  frames  on  the  film  for  the  unit  of  activity  being  studied.  When 
one  frame  of  film  is  briefly  exposed  every  second  during  the  observation 
period,  the  number  of  frames  counted  can  be  equated  to  the  number  of  seconds. 
Reference  to  a  clock  in  the  camera  field  may  also  provide  information  about 
the  passage  of  time,"  (Steidl,  1963b,  page  14). 

A  film  record  has  a  number  of  advantages  over  a  paper  and  pencil  record 
of  an  observation:  it  provides  a  fairly  permanent  record;  it  can  be  analyzed 
for  various  types  of  information;  observations  and  analyses  can  be  verified; 
and  it  permits  reviews  of  activity  which  may  suggest  additional  information 
that  will  contribute  to  the  solution  of  the  problem  or  help  identify  other 
problems . 

A  memomotion  film  also  has  these  advantages : 
.  The  analyst  has  less  film  to  review,  since  it  is  a  more  condensed 
record  than  a  micromotion  film. 

.  Undesirable  conditions  may  be  emphasized,  since  motions  are  jerky 
and  accentuated. 

.  It  is  not  necessary  for  an  observer  to  be  present  during  a  trial 
to  record  what  a  subj  ect  does . 

.  An  hour's  activity  can  be  reviewed  at  normal  speed  of  16  frames 
per  second  in  four  minutes ,  thus  permitting  a  quick  overview  of 
a  trial. 
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.  It  is  well  suited  to  problems  that  do  not  require  as  detailed  analysis 
as  permitted  by  a  micromotion  rate  of  16  or  more  frames  each  second," 
(Steidl,  1963b,  page  14). 

Of  the  disadvantages  of  any  film  record,  the  one  that  is  unique  to 
memomotion  films  stems  from  the  intermittent  record,  i.e.,  action  is  missing 
during  the  unrecorded  periods.    Of  course,  some  information  may  be  missing 
in  any  film  because  the  worker's  back  is  to  the  camera,  thus  concealing  the 
activity.    However,  when  data  are  recorded  also  by  an  observer  concurrent 
with  the  filming,  the  problem  may  be  eased. 

Next,  I  want  to  present  several  examples  of  the  kinds  of  data  from  memomotioi 
film  records  of  a  complex  task- -meal  preparation- -and  films  from  two  of  our 
studies . 


Since  the  data  from  the  films  and  observations  are  objective,  some 
means  of  obtaining  the  person's  evaluation  and  perception  of  the  activity 
and  situation  should  be  used  to  help  interpret  the  objective  data.  For 
instance,  effort  ratings  have  been  correlated  with  total  number  of  center- 
uses  (or  trips) ,  time  at  each  center  (or  work  station) ,  and  the  over  all 
assessment  of  different  arrangements  (Steidl,  1960). 

Interview  method  and  continuity  of  action 

Data  from  personal  interviews  have  also  been  used  to  study  continuity 
of  action  in  household  work.    As  you  would  expect,  the  information  is 
ordinarily  at  a  much  grosser  level  than  that  from  films.    For  instance, 
interviews  asking  for  recall  of  the  preceding  day's  activities  and  the 
estimated  time  for  each  activity  gave  us  knowledge  of  the  number  of  blocks 
or  units  of  activity,  the  duration  of  each,  the  sequence  of  activities, 
and  the  variety  (Steidl,  1963;  see  also  Steidl  and  Bratton,  1968).  From 
these  data  we  obtained  descriptive  information  pertaining  to  continuity  of 
action.    The  number  of  blocks  of  activity  averaged  20  per  homemaker  and 
two-fifths  of  the  blocks  of  activity  continued  for  less  than  30  minutes; 
one-third  of  the  homemakers  reported  actiyities  in  three  activity  areas 
(such  as  food,  clothing,  family)  and  another  one- third  reported  activities 
in  four  activity  areas. 

Our  experience  indicates  that  respondents  can  reconstruct  their  time- 
use,  and  especially  when  the  query  concerns  the  last  24  hours  rather  than 
a  part  of  the  last  24  hours.    The  sequential  listing  of  activities  and 
associated  time  periods  lends  itself  to  several  kinds  of  analyses,  including 
those  indicated. 

Complex  homemaking  tasks  -  interview  method 

Another  approach  to  studying  complex  homemaking  tasks  besides  the 
filmed  observations  is  the  personal  interview,  using  questions  about  the 
cognitive  factors  of  attention,  judgment,  and  planning.  Explanatory 
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information  can  be  obtained  about  the  functioning  of  each  cognitive  factor, 
difficulty  factors,  and  task  preferences,  as  well  as  ratings  for  complexity, 
difficulty  and  preference.    Three  journal  articles  provide  details  of  the 
methodology  and  the  results  from  intensive  interviews  with  a  selected 
population  of  young  wives  (Steidl,  1972;  Steidl,  1975a;  Steidl,  1975b). 
The  information  that  follows  is  based  on  those  articles. 

Open-ended  questions  were  used  and  many  could  be  used  or  adapted  in 
further  studies.    Two  questions  about  homemaking  tasks  in  general 
elicited  a  range  of  information  and  provided  rich  insights  into  the 
concept:  "What  makes  homemaking  tasks  complicated?"    "What  makes  homemaking 
tasks  uncomplicated?"    Following  this,  the  respondent  nominated  tasks 
high  in  attention  and  others  low  in  attention  and  answered  open  questions 
including  these: 

-"Why  do  you  think    (name  of  task)  requires  a  great  deal  of  attention 

(or  judgement,  or  planning)?"  or,  "Why  do  you  think  requires 

very  little  attention  (or  judgement,  or  planning)?" 

"Are  there  any  things  about  your  work  situation  or  where  you  do  this 
task  that  make  the  work  more  difficult?"  and  "Are  there  any  things 
about  your  work  situation  or  where  you  do  this  task  that  make  the 
work  less  difficult?" 

-"What  do  you  like  about  this  task?"  "What  do  you  dislike  about  this 
task?" 

The  coding  of  the  responses  was,  of  course,  time  consuming.  The 
diversity  of  responses  was  impressive.    Some  of  the  diversity  came  from 
the  variety  of  tasks  nominated.    One  advantage  of  the  open-ended  questions 
was  the  richness  of  the  information.    With  this  as  background,  a  more 
structured  interview  schedule  could  be  developed;  broad  categories  might 
be  used,  followed  by  a  request  for  more  specific  information  if  appropriate. 
For  instance ,  the  wives '  explanatory  information  about  the  high  cognitive 
factors  eiq)hasized  the  content  of  the  work,  and  especially  quality  and 
quantity  considerations,  timing  requirements,  and  process  or  procedure 
activities.    Some  wives  also  noted  aspects  of  the  environmental  context -- 
the  house,  community,  and  family. 

MDre  specifically,  the  quality  and  quantity  considerations  often 
concerned  quality,  especially  aesthetically  pleasing  results  such  as 
color,  flavor,  things  going  together;  also  variety  of  products,  interesting 
products;  growth,  health,  diet,  and  nutrition  factors;  attending  to 
temperature  settings  to  obtain  a  quality  product;  and  judging  the 
sturdiness  and  durability  of  items .    The  quantity  considerations  often 
involved  judgments  about  how  much  to  do  or  use. 
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The  timing  considerations  concerned  careful  timing  required;  decisions 
about  when  to  do  the  task;  judging  the  amount  of  time  needed;  and  the 
time  squeeze.    Some  noted  also  timing  tasks  to  prevent  accidents  or 
provide  safety  for  their  children. 

The  liigh  cognitive  tasks  also  required  thought  about  the  process  or 
procedural  activities  such  as  how  to  proceed  with  the  task:  attending, 
judging,  or  planning  how  much,  when,  what  to  use  or  substitute;  and  the 
preparatory  work  and  organizing  work  required. 

The  family  and  human  relations  involved  also  were  among  their  concerns: 
pleasing  self  and  others;  taking  care  of  the  preferences  and  needs  of 
others.    The  age  of  the  child,  the  schedules  of  the  child,  wife,  and  husband 
for  work  and  other  activities  were  other  considerations.. 

The  preceding  examples  are  some  of  the  more  frequent  kind  of 
responses  in  the  wives '  explanations  of  high  cognitive  tasks .    Our  data 
provide  information  about  the  dimensions  of  complexity  of  tasks  and  of 
tasks  that  are  not  complex.    The  wives'  responses  also  point  up  the  impact 
of  their  situation  when  they  are  tight  on  time  and  of  the  social  and  physical 
setting  in  which  tasks  are  done. 

The  relationship  between  difficulty  factors  and  complexity  should 
not  be  overlooked.  The  high  cognitive  tasks  were  rated  almost  equally 
as  easy  and  difficult.  The  homemakers  identified  factors  making  tasks 
both  more  difficult  and  easier  to  do.  Since  about  half  of  each  set  of 
reasons  concerned  the  quality  of  the  physical  environment,  it  should  be 
included  in  further  studies  of  task  complexity. 


Conclusion 

Two  methods  of  studying  complex  homemaking  tasks --the  interview 
and  memomotion  film  analysis --provide  different  kinds  of  information  about 
tasks  and  the  situations  in  which  tasks  are  done.    I^ny  homemaking  tasks 
encompass  time  and  location  variables;  the  worker  controls  some  of  the 
discontinuity  of  action,  the  process  determines  seme,  and  events  external 
to  the  situation  may  affect  further  the  discontinuity  of  action.  Since 
action  is  intermittent,  coordination  of  tasks  is  needed.    Social  inter- 
action makes  additional  demands  on  the  worker's  attention.    The  context 
within  which  tasks  are  done,  such  as  inadequate  time,  multiple  task 
performance,  equipment  breakdown,  and  poor  quality  of  supplies,  may 
contribute  to  difficulty  or  complexity  of  task.    The  nature  of  the  work 
and  the  setting  in  which  it  is  done  are  both  important  in  studying 
task  complexity. 
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Percent  of  center-uses 
N  =  113 


Percent  of  time  at  centers 
N  =  4904  seconds  at  centers 


FLOW  OF  WORK  FOR  PREPARATION  AND  CLEANUP  OF  ONE  DINNER 

The  solid  portions  in  each  column  represent  action  on  a  given  job  for  the 
meal,  the  blank  portions  no  action.     Study  of  the  graphs  shows: 

.  the  number  of  different  times  a  job  received  attention  (meat — 8  times); 

.  proportion  of  center-uses  during  each  attention  period; 

.  proportion  of  time  during  each  active  and  inactive  period; 

.  action  on  several  jobs  during  some  attention  periods  (meat,  potatoes,  gravy); 

.  sequence  of  work  (first  job — dessert;  next — potatoes;  dessert;  meat; 
cleanup ;  etc . ) • 

Discontinuity  of  action  during  preparation  and  comparatively  short  work 
periods  on  each  job  were  common  for  this  menu  (ground  beef  patties;  mashed 
potatoes;  pan  gravy;  tossed  vegetable  salad;  milk,  water,  coffee;  brownies). 

Source:     Steidl,  Rose  E.   (1957)     "Effects  of  Multiple  Water  and  Drainage 
Facilities  on  Work  Involved  in  Family  Meal  Preparation  and 
Cleanup,"  Ph.D.  thesis,  Cornell  University,  Ithaca,  New  York. 
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FLOW  OF  WORK  FOR  PREPARATION  AND  CLEANUP  OF  ONE  DINNER 

The  solid  portions  In  each  column  represent  action  on  a  given  job  for  the 
meal,  the  blank  portions  no  action.     Study  of  the  graphs  shows: 

.  the  number  of  different  times  a  job  received  attention  (meat — 8  times); 

.  proportion  of  center-uses  during  each  attention  period; 

.  action  on  several  jobs  during  some  attention  periods  (meat,  potatoes,  gravy); 

.  sequence  of  work  (first  job — dessert;  next — potatoes;  dessert;  meat; 
cleanup;  etc.)- 

Discontinuity  of  action  during  preparation  and  comparatively  short  work 
periods  on  each  job  were  common  for  this  menu  (ground  beef  patties;  mashed 
potatoes;  pan  gravy;  tossed  vegetable  salad;  milk,  water,  coffee;  brownies). 

Source:     Steidl,  Rose  E.   (1957)     "Effects  of  Multiple  Water  and  Drainage 
Facilities  on  Work  Involved  in  Family  Meal  Preparation  and 
Cleanup,"  Ph.D.   thesis,  Cornell  University,  Ithaca,  New  York. 
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Number  of  trips  into  the  kitchen 


(From  memomotion  films  of  four  meals  in  two 
homes,  before  and  after  adding  functional 
storage  devices,  1959) 


Family  C 

Family  J 

Before 

After 

Before 

After 

Number  of  trips  into  kitchen 

Homemaker 

14 

22 

4 

12 

Helpers 

Work  only 

13 

20 

20 

Visit  only 

1 

10 

11 

Work  and  visit 

1 

1 

13 

7 

Visitors 

8 

18 

3 

Total 

36 

42 

50 

50 

Steidl,  1961b 
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Duration  o£  periods  in  and  out  of  the  kitchen 


(From  memomotion  films  of  four  meals  in  two  homes,  before 
and  after  adding  functional  storage  devices,  1959) 


Homemaker  Helpers  Total  

Duration  Before     After  Before      After  Before  After 


Tn 

Tn 
111 

Tn 

Out 

In 

Out 

In 

C\i  i-f- 
UUt 

T-n  r>i 

in  uut 

Seconds 

Family 

C: 

number  of  periods 

1-29 

8 

11 

10 

16 

11 

4 

1 

19 

15 

11  16 

oU-  by 

i 

1 

0 

•7 

3 

1 

2 

1 

2 

3 

7  3 

60  and  over 

.5 

6 

2 

5 

1 

7 

5 

6  1 

No  data 

2 

3 

3 

1 

5 

4 

Total 

1  A 

14 

14 

22 

22 

14 

14 

2 

2 

28 

28 

24  24 

Family 

J: 

number  of  periods 

1-29 

1 

1 

1 

4 

31 

18 

27 

16 

32 

9 

28  20 

30-59 

3 

3 

5 

7 

5 

6 

5 

7 

8  9 

60  and  over 

3 

8 

1 

7 

12 

6 

9 

10 

12 

14  10 

No  data 

3 

4 

6 

7 

9 

11 

Total 

4 

4 

12 

12 

43 

43 

38 

38 

47 

47 

50  50 

Steidl,  1961b 
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FIGURE  1.    WHAT  MADE  WORK...* 
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FIGURE  2.    WHAT  WAS  IT  ABOUT  THE  HOUSING  AND  FACILITIES  THAT  MADE  WORK. 
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Total  amount 
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Pleasantness 

Design  and  quality 
Availability 

Location  of  equipment  and  task 
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Steidl,  1972  (Based  on  Tables  2  and  3) 
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M.  M.  Ayoub,  is  professor  of  Industrial 
Engineering  and  Biomechanical  Engineering  as  well 
as  Director,  Institute  of  Biotechnology  at  Texas 
Tech  University.    His  research  interests  center 
around  ergonomics ,  with  particular  interest  in 
biomechanics  and  work  physiology. 

The  paper  presented  here,  co -authored  by 
Jerry  Purswell,  University  of  Oklahoma,  and 
John  Hicks,  Cities  Service  Oil  Company,  presents 
an  er genomic  approach  to  data  collection  for  the 
study  of  hand  tool  injuries.    Ayoub  et  al  consider 
the  worker,  the  tool,  the  task,  and  work  practices 
in  their  determination  of  required  information 
and  the  development  of  a  reporting  procedure  for 
hand  tool  injury. 


INTRODUCTION 

The  term  hand  tool  used  in  this  paper  refers  to  any  of  the  wide  range 
of  hand  held  instruments  used  to  perform  a  given  task.    These  hand  tools 
can  be  powered  either  by  muscular  exertion  or  by  outside  source,  but  all 
are  held  and  manipulated  by  the  human  hands  in  a  man- task-environment 
system  consisting  of  the  worker  himself,  the  tool  used,  and  the  environment 
in  which  the  work  is  performed. 

A  hand  tool  should  be  and  is  designed  to  extend  the  human  physical 
capabilities  in  performing  an  activity,  but  at  the  same  time  these  tools 
have  caused  injuries  to  the  user  as  well  as  to  other  individuals  in  a 
variety  of  ways.    As  a  rule  these  accidents  are  often  attributed  to 
negligence  or  bad  luck,  but  rarely,  if  ever,  have  they  been  examined  to 
identify  the  real  mechanism  of  injury  to  eliminate  or  at  least  expose  it 
in  order  to  prevent  repeated  occurrences .    Only  in  recent  years  has  an 
effort  been  made  in  this  country  to  examine  accidents  with  more  interest 
than  just  score  keeping.    This  is  partially  the  result  of  the  Occupational 
Safety  and  Health  Act  of  1970. 
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Data  published  by  the  National  Safety  Council  (1972,  1973)  indicate 
the  severity  o£  hand  tool  injury  problems.    Hand  tool  injury  data  accounts 
for  6%  of  all  compensible  injuries  in  1971  and  1972.    Due  to  the  high 
incidence  and  high  cost  of  tool  injuries,  it  is  imperative  that  efforts 
be  initiated  to  investigate  and  attempt  to  eliminate  the  causes  of  these 
hand  tool  injuries.    Such  action  would  certainly  decrease  the  frequency 
and  severity  of  the  hand  tool  injuries. 

Purpose 

The  purpose  of  this  paper  is  to  show  an  Ergonomic  approach  for  the 
collection,  and  analysis  of  information  on  hand  tool  injuries  and  illnesses 
and  to  test  such  a  system  of  injury  collection  and  analysis  on  a  group  of 
accident  cases  at  Tenker  Air  Force  Base.    This  system  is  presented  in 
detail  in  a  later  section. 

Summary  and  Evaluation  of  Injury  Statistics 

Based  on  the  literature  search  compiled  by  Ayoub,  Purswell  and  Hoag 
(1975) ,  it  was  clear  that  the  injury  data  available  are  related  primarily  to 
incidents  of  a  fatality  or  disabling  injury  which  results  from  hand  tool 
use.    Additional  data  are  available  from  some  states  which  relate  the 
incidence  of  injury  to  a  particular  type  of  hand  tool.    However,  data  are 
not  generally  available  to  relate  the  incidence  of  injury  to  a  particular 
hand  tool  and  mechanism  of  injury.    Of  course,  the  mechanism  of  injury 
can,  in  some  cases,  be  inferred  from  the  statistics  available  for  the  type 
of  hand  tools  such  as  knives ,  but  more  data  are  needed  to  relate  the 
incidence  to  the  mechanism  of  injury. 

For  the  data  available  there  are  differences  in  criteria  used  to 
pay  compensation  for  hand  tool  injuries,  for  instance,  an  injury  may 
be  classified  as  a  disabling  injury  in  California  if  it  results  in 
absences  from  work  one  full  day,  or  shift,  beyond  the  day  of  injury, 
while  the  comparable  period  in  New  York  is  seven  days.    These  differences 
in  criteria  make  it  difficult  to  make  comparisons  between  the  available 
injury  data.    The  following  sections  contain  a  summary  of  the  data 
available  on  injuries  resulting  from  hand  tool  use. 

A.    Hand  Tool  Injuries  as  a  Proportion  of  All  Compensable  Injuries 

The  National  Safety  Council  (1973,  1972)  published  the  data  shown  in 
Table  1  on  the  source  and  cost  of  compensable  work  injuries  as  reported  by 
state  labor  departments  in  the  U.S.  for  the  calendar  years  of  1971  and 
1972. 

It  can  be  seen  that  hand  tool  injuries  accounted  for  six  percent  of 
all  injuries  and  the  average  cost  of  compensation  only  for  each  accident 
was  $740  in  1971  and  $850  in  1972.    The  relative  position  of  the  various 
injury  sources  as  a  percentage  of  all  injuries  did  not  change  from  1971  to 
1972,  but  the  average  compensation  costs  did  increase  approximately 
15  percent  for  each  injury  source.    Comparable  data  for  a  calendar  year 
1973  was  not  published  in  the  1974  edition  of  Accident  Facts. 


72 


TABLE  1 


SOURCE  AND  COST  OF  COMPENSABLE  WORK  INJURIES 


Average 

Percent  of  Compensation 


All 

Cases 

Costs  pe 

r  Case 

Source  of  Injury 

1971 

1972 

1971 

1972 

Handling  objects,  manual 

23 

23 

$  990 

$1,140 

Falls 

20 

20 

1,470 

1,690 

Struck  by  falling,  moving 
ODj  ecus 

1  A 

/  oU 

oDU 

Machinery 

10 

10 

1,110 

1,280 

Vehicles 

7 

7 

1,570 

1,800 

Stepping  on,  striking  against 
obj  ects 

7 

7 

480 

550 

Hand  tools 

6 

6 

740 

850 

Other 

13 

13 

1,182 

1,350 

Accident  Facts,  1972  and  1973  editions. 
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Data  published  by  the  State  of  New  York  for  the  period  1966  through 
1970  (1972)  show  that  injuries  resulting  from  hand  tool  use  account  for 
7.0  percent  of  all  injuries  and  4.9  percent  of  the  compensation  awarded 
accident  victims.    The  average  cost  of  compensation  per  hand  tool  injury 
was  $1,305.    The  data  available  from  New  York  were  summarized  for  the  five- 
year  period  but  no  annual  information  was  available  to  determine  any  time 
trends . 

The  State  of  California  published  information  annually  on  work  injuries, 
so  it  is  possible  to  infer  the  time  trend  of  injuries  resulting  from  hand 
tool  use  as  shown  in  Table  2. 

The  data  in  Table  2  indicate  that  hand  tools  were  involved  in 
approximately  9.0  percent  of  all  disabling  injuries  and  1.9  percent  of 
fetalities  over  the  six-year  period  of  1967-1972.    There  is  also  an 
indication  that  the  trend  of  hand  tool  injuries  is  upward  over  the  last 
three  years  of  data  (1970-1972) . 

Data  were  not  available  from  California  on  the  average  compensation 
cost  of  a  hand  tool  injury. 

Table  3  presents  data  for  the  State  of  Ohio,  showing  the  percentage 
of  fatalities  and  injuries  produced  by  hand  tools  for  all  compensable 
injuries . 

A  comparison  of  these  various  data  sources  indicates  differences 
from  state  to  state,  but  in  general,  it  can  be  concluded  that  injuries 
resulting  from  hand  tool  use  account  for  5-10  percent  of  all  compensable 
injuries . 

B.    Injuries  Resulting  from  Powered  Versus  Nonpowered  Hand  Tools 

The  data  available  from  New  York,  California,  and  Ohio  for  hand  tool 
injuries  include  a  number  of  subclasses,  permitting  an  analysis  of  powered 
versus  nonpowered  hand  tool  injuries.    Table  4  presents  data  for 
California  showing  powered  hand  tool  injuries  as  a  percentage  of  all  hand 
tool  injuries. 

Table  5  presents  data  from  the  State  of  Ohio  for  powered  hand  tool 
injuries  as  a  percentage  of  all  hand  tool  injuries. 

Data  from  the  State  of  New  York  for  1966-1970  indicate  that  21.1  percent 
of  hand  tool  accidents  were  produced  by  powered  hand  tools ,  and  that  the 
average  compensation  cost  per  case  was  $1,610  compared  to  $1,221  per  case 
for  nonpowered  hand  tool  accidents.    Considering  the  data  from  these 
three  states  as  typical,  it  can  be  stated  that  powered  hand  tools  account 
for  21-29  percent  of  all  hand  tool  injuries.    It  may  also  be  inferred  from 
the  New  York  data  that  compensation  for  a  powered  hand  tool  accident  will 
be  an  average  of  approximately  $400  more  than  for  a  non-powered  hand  tool 
accident . 

Referring  to  Table  1  presented  earlier,  it  may  also  be  observed  that 
the  cost  of  a  hand  tool  compensation  claim  in  New  York  was  almost  twice 
the  national  average. 
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TABLE  2 


FATALITIES  AND  DISABLING  INJURIES  RESULTING  FRCM  HAND  TOOLS 
TOTAL  USE  IN  CALIFORNIA  FOR  THE  PERIOD  1967-1972 
AS  PERCENTAGE  OF  ALL  INJURIES 


Year 

Hand  Tool  Fatalities 
as  Percent  of  All 
Fatalities 

Hand  Tool  Injuries 
as  Percent  of  All 
Injuries 

1967 

1.5 

8.7 

1968 

1.4 

9.0 

1969 

2.0 

8.8 

1970 

2.1 

8.7 

1971 

1.5 

9.0 

1972 

2.8 

9.4 

TABLE  3 

FATALITIES  AND  DISABLING  INJURIES  PRODUCED  BY  HAND  TOOLS 
AS  A  PERCENTAGE  OF  ALL  COMPENSABLE  INJURIES 
FOR  THE  STATE  OF  OHIO 

Year 

Hand  Tool  Fatalities 
as  Percent  o£  All 
Fatalities 

Hand  Tool  Injuries 
as  Percent  of  All 
Injuries 

1969 

Not  Available 

4.7 

1970 

1.0 

4.8 

1971 

2.1 

5.0 

1972 

1.2 

5.1 

-1973 

Not  Available 

5.5 
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TABLE  4 


INJURIES  RESULTING  FROM  POWERED  HAND  TOOL  USE  AS  A  PERCENTAGE 
OF  HAND  TOOL  INJURIES  FOR  STATE  OF  CALIFORNIA 


Year  Percentage 


1967 

26.6 

1968 

27.4 

1969 

28.5 

1970 

28.2 

1971 

25.1 

1972 

29.1 

TABLE  5 

INJURIES  RESULTING  FROM  POWERED  HAND  TOOL  USE  AS  A  PERCENTAGE 
OF  ALL  HAND  TOOL  INJURIES  FOR  STATE  OF  OHIO 


Year  Percentage 


1969 

22.8 

1970 

20.6 

1971 

24.2 

1972 

23.1 

1973 

21.6 
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C.    Injuries  Related  to  Specific  Type  of  Hand  Tool  Use 


The  data  from  New  York,  Ohio,  and  California  were  analyzed  to  obtain  the 
percentage  of  total  hand  tool  injuries  contributed  by  each  type  of  hand  tool. 
Some  problems  exist  in  obtaining  comparable  classifications  of  injuries  by 
type  of  hand  tool  in  each  state,  but  these  were  generally  overcome  by 
rearrangements  of  the  detailed  accident  data  where  necessary.    Table  6 
presents  the  data  for  hand  tool  type  versus  percentage  of  total  hand  tool 
injuries  for  New  York,  Ohio,  and  California. 

It  can  be  seen  from  Table  6  that  there  is  very  good  agreement  among 
the  three  states  over  several  years  of  data  on  the  1,  2,  and  3  relative 
ranking  of  hand  tool  injuries  produced  by  knives,  wrenches,  and  hand 
hammers .    There  is  also  good  general  agreement  on  the  relative  ranking  of 
the  frequency  of  injury  for  the  other  hand  tools  within  the  list. 
Exceptions  to  this  general  agreement  in  ranking  are  where  the  basic  data 
do  not  permit  data  tabulation  on  a  comparable  basis  for  a  particular  tool 
type  such  as  a  bar  or  pneumatic  tool.    The  data  in  Table  6  can  be  considered 
to  represent  one  type  of  priority  listing  for  defining  research  requirements 
to  inprove  the  safety  of  hand  tool  use.    Of  course,  it  would  be  very 
desirable  to  have  some  estimate  of  the  relative  exposure  of  a  worker  in 
using  each  type  of  tool  in  order  to  more  effectively  plan  a  research 
program,  but  such  data  are  unavailable. 

Another  consideration  in  establishing  research  program  priorities  is 
the  cost  of  a  given  type  of  hand  tool  injury  as  compared  to  the  frequency 
of  injury.    As  stated  earlier,  the  only  data  available  which  relate 
compensation  costs  to  a  specific  hand  tool  injury  type  is  New  York  state. 
Table  7  presents  these  data. 

It  can  be  seen  from  Table  7  that  injuries  resulting  from  the  use  of 
shovels  and  spades  result  in  the  highest  compensation  costs  of  all  hand 
tools,  while  only  ranking  fifth  in  number  of  injuries  among  all  hand  tools. 
Similarly,  injuries  resulting  from  the  use  of  knives  rank  fourth  highest 
in  compensation  costs  while  ranking  number  one  in  frequency  of  injury. 
Such  differences  in  incidence  of  injury  versus  condensation  cost  of  the 
injury  must  be  taken  into  account  in  the  establishment  of  research  priorities. 

In  order  to  consider  the  development  of  control  measures  to  prevent 
hand  tool  injuries,  it  is  necessary  to  have  an  understanding  of  the 
mechanism  of  injury  as  noted  earlier  in  this  paper.    The  most  complete 
data  available  in  this  case  is  from  the  State  of  Ohio.    Table  8  presents 
a  conpilation  of  data  for  various  hand  tool  categories  where  the  type  of 
accident,  nature  of  injury  and  part  of  body  injured  are  shown.  The 
following  comments  for  knife  and  wrench  injuries  illustrate  how  the  data 
in  Table  8  may  be  used  to  better  understand  the  mechanism  of  injury: 

(1)    Knife  -  lacerations  account  for  89  percent  of  all  injuries,  as  would 
be  expected.    Most  of  these  lacerations  occur  on  the  fingers  and 
hands . 
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TABLE  6 


PERCENTAGE  AND  RELATIVE  RANK  OF  SPECIFIC  HAND  TOOL 
INJURIES  AMONG  ALL  TYPES  OF  HAND  TOOL  INJURIES  FOR 
NEW  YORK,  OHIO,  AND  CALIFORNIA 


Percentage  and  Rank  of 
 Hand  Tool  Injuries  

New  York  Ohio  California 

Type  of  Hand  Tool  1966-1970  1969-1973  1967-1972 


%     Rank  %     Rank  %  '  Rank 


Knife 

17,0 

1 

17.7 

1 

17.7 

1 

Wrench 

lU.  o 

L 

il .  o 

Z 

z 

Hand  hammer 

9.2 

3 

7.1 

3 

7.1 

3 

Nozzle/hose 

3.9 

7 

3.5 

6 

5.0 

4 

Shovel/spade 

4.2 

6 

5.0 

4 

4.2 

5 

Bar 

6.2 

4 

1.4 

10 

3.5 

8 

Scissor/ shear 

1.8 

11 

0.8 

12 

3.3 

9 

Power  drill 

3.2 

10 

3.7 

5 

2.8 

10 

Power  saw 

3.4 

8 

3.3 

7 

3.8 

7 

Grinder 

1.0 

12 

1.9 

9 

2.5 

11 

Sledge 

3.3 

9 

3.3 

7 

2.1 

12 

Pneumatic  tools 

5.1 

5 

0.9-^ 

11 

4.0 

6 

Some  pneumatic  tool  injuries  classified  in  non-hand  tool 
categories . 
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TABLE  7 


TOTAL  COST  AND  COST  PER  CASE  FOR  SPECIFIC 
TYPES  OF  HAND  TOOL  INJURIES  FROM  STATE  OF 
NEW  YORK  FOR  PERIOD  1966-1970 


Total  Cost  o£ 


Type  of  Hand  Tool 

Compensation 

Cost  per  Case 

Shovel /Spade 

$4,199,400 

$3409 

Wrenches 

4,037,100 

1260 

Hammer 

3,217,300 

1178 

Knife 

2,991,500 

595 

Bars 

2,732,400 

1483 

Pneumatic 

2,423,600 

1606 

CI  pdcro 

lJ  ^  ^  V-*  tl  \^ 

1  943  700 

1967 

Hoses/Nozzle 

1,925,100 

1655 

Power  Saw 

1,676,400 

1647 

Power  Drill 

1,351,000 

1434 

Scissors/Shears 

660,100 

1211 

Hook 

59Z,900 

1808 

Power  Grinder 

324,300 

1150 

79 


(2)    Wrench  -  the  most  frequent  type  of  accident  is  slipping  (without 
falling,  which  is  another  category  of  accident)  or  overexertion. 
Injuries  where  a  person  is  struck  by  a  moving  object  are  also 
important.    The  most  common  type  of  injury  is  a  sprain  or  strain, 
with  contusions  being  the  second  most  frequent  type  of  injury. 
Injuries  to  the  low  back  occur  most  often,  with  the  arms,  hands 
and  fingers  also  becoming  involved  in  a  significant  number  of 
wrench  accidents. 

These  two  exanples  illustrate  the  type  of  information  contained  in 
Table  8  for  each  type  of  hand  tool.    Such  information  is  not  detailed  as 
could  be  desired  to  fully  understand  the  circumstances  of  each  type  of 
hand  tool  accident,  but  it  does  provide  the  best  basis  available  for 
understanding  hand  tool  accidents  sufficiently  to  outline  a  program  of 
research  in  the  area.    The  objectives  of  this  program  of  research  will  be 
the  collection  of  additional  data  which  can  be  used  to  design  safer  hand 
tools  and  workplaces . 

The  following  section  provides  an  analysis  of  the  requironents  for 
injury -relating  data,  given  the  type  of  information  which  is  currently 
available  for  hand  tool  injuries  and  taking  into  account  the  needs  for 
additional  data  before  safer  hand  tools ,  workplaces  and  work  practices  can 
be  designed. 

Requirements  of  Injury-Relating  Data 

The  statistics  available  today  on  injuries  and  illnesses  caused  by  the 
use  of  hand  tools  are  inadequate  for  an  evaluation  of  the  characteristics  of 
the  tool  design,  user  practices,  task  design,  and  the  worker  which 
contributed  to  an  accident  or  illnesses .    Available  information  can  be 
divided  into  three  classes :     (1)  statistical  information  on  the  number  of 
injuries  by  industry,  age,  severity,  cost,  etc.,  (2)  anecdotal  accounts 
published  in  safety  or  trade  journals  whose  intent  is  to  promote  safety, 
and  (3)  medical  articles  concerned  with  the  treatment  or  description  of 
the  injury  or  illness. 

The  type  of  statistical  information  available  has  been  presented  in 
the  previous  sections.    It  was  noted  that  the  data  can  only  be  used  to 
generally  indicate  the  agency  of  injury  for  a  specific  hand  tool,  leaving 
unanswered  many  questions  about  the  mechanism  of  injury.    Both  anecdotal  and 
medical  reports  have  purposes  which  are  not  necessarily  consistent 
with  resolving  tool  design  problems.    Anecdotal  accounts  of  injuries 
typically  emphasize  the  need  for  better  work  practices,  maintenance  of 
tools,  and  using  the  correct  tool  for  the  job.    Seldom  is  any  information 
given  on  the  number  of  workers  exposed  to  the  hazard,  the  number  of  accidents 
which  occurred  or  factors  which  may  have  indirectly  contributed  to  the 
situation.    Medical  accounts  of  injuries  are  primarily  concerned  with 
treatment  of  the  injury  with  only  a  brief  description  of  how  the  injuries 
occurred.    Medical  accounts  of  illness  are  more  informative  of  variables 
which  influence  the  condition  and  frequency  of  occurrence  in  the  population, 
but  frequently  lack  quantitative  information  on  the  tools  and  workplace 
in  which  the  illness  or  injury  developed. 
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This  section  of  the  paper  discusses  the  general  requirements  o£  data 
collected  to  provide  the  information  basis  for  assessing  the  importance 
of  characteristics  of  the  worker,  the  tool,  the  task  and  the  work  practices 
in  the  occurrence  of  injuries  and  the  development  of  occupational  illnesses. 

A.  Description  of  Data  Requirements 

An  outline  of  the  requirement  of  injury-related  data  is  shown  in 
Figure  1.    Notice  that  the  injuries  and  illnesses  are  categorized  by 
several  factors.    For  each  accident  or  illness  a  complete  description  of 
the  conditions  relevant  to  the  situation  are  described.    The  system 
characteristics  of  the  worker,  tool,  task  and  work  practices  are  all 
considered  in  terms  of  the  injuries  and  illnesses  associated  with  these 
factors.    The  system  characteristics  such  as  the  worker,  tool,  etc. 
are  further  subdivided  into  the  individual  factors  associated  with  each 
major  characteristic. 

Through  a  planned,  coordinated  set  of  studies,  the  importance  of 
these  system  characteristics  to  the  design  of  the  various  types  of  tools 
can  be  evaluated.    Basically  two  types  of  information  are  required: 
(1)  Detailed  information  on  actual  injuries  and  illness  to  assess  the 
causes,  and  (2)  studies  of  the  impact  of  specific  attributes  of  the  work, 
tool,  task,  or  work  practices  on  the  occurrence  of  accidents  and  illnesses. 
The  first  category  of  information  has  to  be  collected  in  industry,  while 
the  second  category  of  information  can  be  developed  in  a  laboratory  or  a 
combination  of  laboratory- field  studies.    The  sections  which  follow  describe 
the  information  required  in  each  of  the  categories . 

B.  Information  about  the  Worker 

The  information  required  in  this  section  is  descriptive  information 
about  the  worker  which  may  permit  an  evaluation  of  which  characteristics 
of  the  worker  directly  or  indirectly  contributed  to  the  injury  or  illness. 
These  data  are  required  based  on  the  assumption  that  all  the  relevant 
antecedents  may  not  be  recognized  by  the  safety  or  medical  personnel 
writing  the  report,  and  it  is  possible  that  the  relationship  between  the 
antecedents  and  the  accident  or  illness  may  not  be  understood  by  the 
researcher  in  the  area.    Briefly  the  areas  of  information  required  are: 

(1)  Anthropometry- -A  complete  description  of  the  size  of  the  members  of 
the  body  which  are  used  to  control  the  tool  and  the  angles  between  the 
links  of  the  body  when  the  tool  is  operated.    Special  attention  must 
be  given  to  describing  the  position  of  the  hand. 

(2)  Motor  Skills - -A  profile  of  motor  skills  of  the  workers  to  obtain  any 
relationships  between  these  skills  and  accidents.    For  example,  Welford 
(1958)  made  the  observation  that  accident  prone  workers  have  better 
than  average  motor  skills ,  but  in  young  workers  a  combination  of  too 
much  confidence  in  their  motor  skills  and  inexperience  reduced  their 
ability  to  recognize  a  dangerous  situation  and  led  to  the  more  frequent 
occurrence  of  accidents.    This  observation  requires  verification  on  a 
U.S.  population  of  workers. 
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(3)  Sensory  Skills  and  Sensory  Feedback- -A  profile  is  needed  of  the 
acuities  of  the  visual,  aural,  tactal  and  proprioceptive  senses  and 
the  ability  of  the  worker  to  use  this  information. 

(4)  Psychomotor  Skills- -Measures  of  the  ability  of  the  individual  to  combine 
mental  processes  with  motor  processes  will  provide  the  opportunity 

to  assess  the  importance  of  skills  such  as  hand-eye  coordination  on 
the  occurrence  of  injuries. 

(5)  Training  and  Experience- -Training  and  experience  will  be  an  indicator 
of  the  knowledge  the  individual  has  of  the  tool ,  the  correct  methods 
of  using  the  tool  and  the  potential  dangers  associated  with  its  use. 
One  basic  assumption  has  to  be  made  in  using  experience  as  a  measure 
of  knowledge.    This  assumption  is  that  the  opportunities  for  learning 
are  directly  proportional  to  the  years  of  experience,  i.e.,  that  with 
an  increased  number  of  years  of  experience  more  learning  experiences 
will  be  encountered  instead  of  repeating  the  same  learning  experiences . 
A  measure  of  the  value  of  training  and  experience  on  the  rate  of 
occurrence  of  injuries  and  illnesses  will  then  result. 

Some  of  the  information  in  these  five  categories  can  and  should  be 
collected  on  the  job  at  which  the  injury  occurred  or  the  illness  developed 
while  other  information  will  have  to  be  collected  in  research  projects. 
For  example,  the  cost  of  periodical  surveys  of  the  motor  skills,  sensory 
skills  and  psychomotor  skills  of  a  large  segment  of  a  company's  work 
force  cannot  economically  be  justified  as  a  routine  procedure.  Information 
on  the  anthropometry,  training  and  experience  of  a  worker  who  is  injured 
or  becomes  ill  would  not  be  prohibitively  expensive  to  obtain.  Therefore, 
research  studies  on  selected  populations  of  workers  should  be  conducted  to 
evaluate  the  role  of  motor  skills ,  sensory  skills  and  psychomotor  skills  on 
injuries  and  illnesses.    Information  on  the  anthropometry,  training  and 
experience  should  be  collected  as  routine  investigative  information  whenever 
a  work  related  injury  or  illness  occurs. 

The  measure  of  the  attributes  also  determines  the  approach  to  collecting 
the  information.  Measurement  of  the  motor,  perceptual  and  psychomotor  skills 
requires  special  training  and  equipment  which  is  expensive.    By  comparison, 
the  cost  of  collecting  anthropometric  data  and  assessing  the  training  and 
experience  level  is  considerably  less  expensive. 

C.    Information  about  the  Tool 

The  information  about  the  tool  is  subdivided  into  descriptive  information 
about  the  tool,  its  construction  and  how  it  operates  and  information 
describing  the  physical  coupling  between  the  tool  and  its  operator  and 
between  the  tool  and  workers  in  the  immediate  area  surrounding  the  operator. 
In  the  literature,  the  following  reasons  are  frequently  given  for  injuries 
involving  liand  tools:    (1)  using  the  wrong  tools  for  the  job,  (2)  insufficient 
or  incorrect  maintenance  of  tools,  (3)  using  the  tools  improperly, 
(4)  ijnproper  storage  of  tools,  (5)  defective  tools  and  (6)  failure  to  use 
protective  gear.    But  these  causes  are  not  discussed  in  terms  of  the 
frequency  of  these  factors  being  involved  in  accidents,  e.g.,  no 
information  is  presented  on  the  percentage  of  hand  tool  accidents  which  are 
caused  by  use  of  the  wrong  tool  for  the  job. 
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In  1970,  there  were  1472  disabling  injuries  reported  in  California 
which  involved  wrenches ,  but  descriptive  information  was  not  provided  which 
will  help  reduce  future  injuries  through  avoidance  of  the  hazardous 
condition  which  contributed  to  the  accidents.    In  1972,  381  cases  of 
accidents  involving  wrenches  were  reported  in  Ohio.    Of  these  381  cases, 
199  (52%)  involved  a  slip  or  overexertion,  52  (14%)  involved  striking 
an  object  or  material  and  116  (30%)  involved  being  struck  by  a  moving 
object.    It  is  possible  to  speculate  on  the  causes  of  these  accidents,  but 
no  information  is  provided  which  could  be  used  to  test  the  hypotheses . 
Only  by  isolating  the  specific  causes  of  accidents  can  progress  be  made 
in  reducing  accidents  and  illnesses . 

The  information  which  is  required  includes  the  attributes  of  the  tool, 
how  it  is  used  or  misused  and  the  contribution  of  the  various  aspects  of  the 
job.    Using  information  from  anecdotal  reports,  knowledge  of  the  design  of 
tools,  statistical  reports  such  as  the  Ohio  data  and  experience  with  the 
use  of  a  tool,  data  collection  studies  need  to  be  designed  to  obtain 
information  from  accidents  and  illness  cases  which  will  lead  to  an 
improved  understanding  of  the  role  of  tool  design  in  injuries  and  illnesses. 

D.  Information  about  the  Task 

This  category  of  information  provides  a  description  of  the  task  and  its 
attributes  which  might  contribute  to  the  occurrence  of  accidents  or 
illnesses.    Specifically  included  in  this  category  are:    (1)  a  description 
of  the  workplace,  (2)  a  description  of  the  workpiece,  (3)  a  description  of 
the  environment  and  (4)  a  description  of  job  requirements.    The  information 
included  in  the  description  of  the  work  piece  will  depend  on  the  task,  but 
in  general  should  include  information  to  describe  the  position  of  the 
worker  while  performing  the  task,  facilities  for  proper  storage  of  tools 
and  material,  housekeeping  practices  and  the  relationship  (spatial)  with 
other  workplaces  and/ or  machines .    To  describe  the  workpiece ,  information 
on  the  operation  performed  on  the  workpiece  and  the  material  from  which  the 
workpiece  is  constructed  is  required.    Environmental  information  includes 
the  noise,  illumination,  radiation,  vibration,  heat  (or  cold)  and  air 
quality  at  the  workplace.    Finally,  the  job  requirements  include  information 
on  the  forces,  pressures,  and  job  duration. 

E.  Work  Practices 

Included  under  this  category  is  a  description  of  the  work  practices 
(i.e.,  methods  and  procedures)  used  to  accomplish  the  job.    These  practices 
might  be  a  function  of  the  individual  worker,  the  company's  policies  or 
equipment,  or  industry-wide  methods.    They  might  also  be  influenced  by 
government  regulations,  e.g.,  an  OSHA  regulation  might  determine  a  work 
practice  which  influences  the  health  or  safety  of  the  workers  by  altering 
the  method  used  in  performing  the  job. 

It  can  be  seen  from  the  foregoing  descriptions  of  requironents  for 
injury-related  data  that  a  high  priority  must  be  given  to  developing  a  more 
useful  data  base  of  liand  tool  injury  and  illness  information.    This  data  base 
must  contain  sufficiently  detailed  information  for  the  major  hand  tool 
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types  to  permit  an  analysis  of  the  mechanism  of  injury.    Control  measures 
can  be  successfully  developed  for  hand  tool  injuries  only  after  the  required 
data  liave  been  collected.    The  most  appropriate  methods  for  collecting  these 
data,  taking  into  account  the  costs  and  benefits  involved,  must  be  developed 
in  a  research  program. 

The  Proposed  Approach 

In  order  to  develop  an  appropriate  procedure  for  the  collection  of  hand 
tool  injury  data,  the  following  steps  were  chosen: 

1.  Determination  of  the  information  required  to  describe  the 
accident  and  possibly  to  later  estimate  the  contribution  of 
less  obvious  psychological  and  physiological  factors. 

2.  Construction  of  a  suitable  form  and  reporting  procedure. 

3.  Evaluation  of  several  injury  cases  to  establish  the  usefulness 
and  effectiveness  of  the  information  collected. 

4.  An  iterative  process  of  steps  1,  2,  and  3;  continued  until  the 
procedure  is  proven  to  be  suitable. 

To  determine  the  information  required  to  identify  the  cause  of  an 
accident,  it  is  useful  to  consider  an  example.    Consider  a  case  involving 
an  electrician  who  cut  the  palm  of  his  left  hand  while  replacing  some 
wiring  on  a  large  aircraft.    Many  factors  may  be  directly  or  indirectly 
involved  including  workplace  limitations,  a  faulty  tool,  inexperience  in 
a  skill  required  by  the  task,  and  others. 

To  collect  the  needed  information,  the  system  characteristics  approach 
of  Ayoub,  Purswell  and  Hoag  (1975)  was  employed.  It  covered  all  aspects  of 
the  worker,  the  tool,  the  task.    These  are  summarized  in  Figure  1. 

Information  collected  about  the  worker  is  generally  on  anthropometry, 
training,  and  experience.    Measurements  of  motor  skill,  psychomotor  skill 
and  sensory  feedback  ability  are  considerably  more  complex  than  collecting 
the  survey  type  information  and  would  require  a  large  segment  of  the  worker's 
costly  time.    For  this  reason,  collection  of  this  type  of  information  should 
be  confined  to  selected  populations  of  workers .    Results  could  then  be 
related  statistically  to  the  large  study  population  to  assess  their  role 
in  causes  of  hand  tool  accidents .    In  this  case ,  however ,  an  effort  was  made 
to  test  motor  and  psychomotor  skills  through  administration  of  the  One-Hole 
test.     (Salvendy,  1975)  Designed  to  test  the  ability  of  an  individual  to 
acquire  a  manipulative  skill  rapidly,  it  was  used  here  to  investigate 
the  effectiveness  and  practicality  of  such  a  test  in  this  context.  In 
collecting  injury  data,  a  safety  representative  should,  collect  information 
including  name,  age,  sex,  measurements  of  the  hand  and  arm  and  their 
positions  during  the  task,  and  training  and  experience  in  this  and  similar 
jobs,  as  well  as  conduct  the  administration  of  a  motor  skill  and 
psychomotor  skill  test  in  this  instance.    Data  collected  concerning  the 
tool  should  include  all  of  the  subheadings  listed  under  tool  in  Figure  1. 
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To  describe  the  task  it  is  necessary  to  include  a  workplace 
description,  a  workpiece  description,  a  summary  of  task  requirements; 
meaning  a  description  of  necessary  forces,  torques,  pressures  and  their 
duration.    For  the  example,  the  information  required  may  be: 

workplace  -  on  left  side  of  aircraft,  15  feet  above  ground  on  a 
metal  scaffold.    Working  at  face  level. 

workpiece  -  2  ft.  x  3  ft.  panel  of  several  hundred  wires. 

task  requirements  -  very  light  grip  pressure  and  shoulder  torque. 

environment  -  70  degrees,  loud  constant  noise,  clean  area, 
adequate  lighting. 

All  of  the  relevant  information  concerning  work  practices  should  be 
collected  immediately  from  the  individual  involved,  where  possible,  and  the 
supervisor.    All  practices  (i.e.,  methods  and  procedures)  used  in  the 
performance  of  the  task;  whether  individual,  company  policy  or  government 
regulation  must  be  included.    The  aircraft  worker  in  the  example  might  state 
only  that  he  used  a  square  knot  off  center  method  of  splicing  and  that  no 
other  practices  are  applicable.    For  this  study  all  of  the  work  practice 
categories  were  included  in  data  collection  efforts . 

In  addition  to  the  system  characteristics  associated  with  an  accident 
it  is  also  possible  that  non-obvious  stress  factors  contributed  to  the 
accident.    Stress  profile  questionnaires  may  be  useful.    A  sample  used  is 
attached  (attachment  1) . 

Another  factor,  job  dissatisfaction,  may  also  contribute  to  the 
occurrence  of  an  accident.    Any  relationship  between  job  dissatisfaction 
and  accidents  is,  however,  unclear  at  this  time.    (Scott,  1972)  Therefore, 
no  attempt  to  measure  this  factor  was  made. 

The  information  collected  in  each  case  was  evaluated  to  determine 
if  any  characteristics  of  the  worker,  the  tool,  the  task  or  work  practices 
contributed  to  the  occurrence  of  each  accident.    Since  the  purpose  of  this 
study  was  to  develop  a  reporting  system  and  involves  a  small  data  base; 
no  specific  recommendations  for  reducing  hand  tool  injuries  were  made. 

With  the  previously  discussed  information  requirements  in  mind,  a 
report  form  and  procedure  were  developed  incorporating  the  most  advantageous 
combination  and  sequence  of  activities.    The  form  (attachment  2)  is 
standardized  and  includes  a  list  of  instructions.    Further  breakdown  and 
standardization  may  be  needed  to  collect  more.    The  form  was  used  in  a  pilot 
study  at  Tinker  Air  Force  Base. 

In  this  Pilot  study  the  procedure  followed  was: 

1.  Location  of  subject 

2.  Completion  of  forms 

3.  Administration  of  the  One  Hole  Test 
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Data  were  collected  in  cooperation  with  the  Tinker  Air  Force  Base 
Safety  Office.    All  workers  involved  were  employed  by  the  Air  Force 
Logistics  Command  which  in  1974  reported  13.5  percent  of  its  work  related 
accidents  to  be  associated  with  hand  tools . 

The  initial  data  were  collected  over  a  period  of  two  days.    First,  all 
accidents  which  occurred  in  June  1975  were  surveyed  and  thirteen  cases 
involving  handtools  were  extracted  from  the  files .    After  consulting  with 
supervisors  a  week  in  advance,  it  was  found  that  ten  of  the  thirteen 
would  be  available  for  consultation. 

The  information  collected  in  each  case  was  evaluated  to  determine  that 
characteristics  of  the  worker,  the  tool,  the  task  or  work  practices 
contributed  to  the  occurrence  of  each  accident.    With  the  previously 
discussed  information  recpairemients  in  mind,  the  complete  processing  of  each 
subject  required  approximately  ninety  minutes;  thirty  minutes  for 
information  collection  and  the  rest  for  travel  and  subject  location  time. 

Results  and  Discussion 

Information  collected  from  the  initial  ten  subjects  revealed  the 
following: 


More  specifically.  Table  9  shows  the  predominance  of  manual  tools  and 
finger  injuries  in  the  group  of  accidents  surveyed. 

This  is,  of  course,  too  little  information  to  identify  any  trends  but 
is  sufficient  to  demonstrate  that  such  details,  descriptive  of  the  injury 
population,  may  easily  be  collected  incidental  to  investigation  for 
cause.    It  is  felt  that  the  body  of  information  collected  did  in  fact 
prove  adequate  to  describe  all  of  the  accidents  in  terms  of  the  system 
characteristics .    Table  10  summarized  the  system  characteristics  which 
were  identified  as  contributing  factors  in  the  causes  of  the  initial  ten 
accidents . 

A  validation  of  the  effectiveness  of  the  collected  information  was 
accomplished  by  selecting  five  additional  accident  cases  and  investigating 
them.    Again  all  of  the  cases  were  easily  described  in  terms  of  the  system 
characteristics  involved.    The  data  allowed  an  independent  expert  to 
judge  that  he  had  a  good  understanding  of  each  accident  after  reading 
the  reports. 


Sex 

Average  age 
Training 


9  males ,  1  female 
36  years 

2  subjects  were  trained  to  use 


Average  experience 
Average  time  missed 
due  to  injury 


the  tool  involved 
10.9  years 


85.5  minutes 
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TABLE  9 


SOURCE  OF  INJURY  MID  BODY  PART  INJURED  FOR  TEN  CASES 
AT  TINKER  AIR  FORCE  BASE 


Body  Part 


Tool 

Head 

Hand 

Finger 

Arm 

elec.  drill 

1 

1 

1 

elec.  saw 

1 

wrerich 

1 

1 

saw 

1 

pliers 

1 

file 

1 

razor  blade 

1 
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The  information  collected  for  the  five  additional  accident  cases 
showed  significant  similarity  to  the  results  in  the  initial  effort. 
Table  11  summarized  the  data  in  terms  of  the  system  characteristics . 
Tables  10  and  11  suggest  several  interesting  trends  and  conclusions  which 
will  be  discussed  later  in  the  Discussion  and  Conclusion  section.    While  the 
amount  of  data  are  too  small  to  be  conclusive  and  no  scores  for  the  whole 
worker  population  are  available,  it  appears  that  the  One  Hole  Test  may 
be  useful  in  pinpointing  a  deficiency  in  motor  skill  level.  Certainly 
it  will  be  important  to  investigate  motor  skill  as  a  system  characteristic. 

The  results  of  the  life  stress  profile  were  difficult  to  interpret. 
Although  there  are  no  population  norms  to  compare  to,  the  finding  suggests 
a  tendency  toward  risk  taking  behavior.    How  much  this  would  account  for 
the  common  disregard  of  safe  work  practices  is  uncertain  since  many 
additional  factors  must  be  considered  such  as  simple  overconfidence, 
supervisor  pressure  to  increase  productivity,  and  ignorance  of  safety 
rules  etc. 

Having  established  information  requirements  and  shown  the  system 
characteristics  approach  to  be  a  reasonable  method  to  describe  an 
accident  for  the  purpose  of  analysis ;  it  remains  to  be  decided  how  control 
measures  can  be  developed.    After  a  major  data  collection  effort,  the 
data  will  likely  point  to  some  obvious  controls  such  as  use  of  gloves 
with  certain  tools  or  wider  use  of  safety  glasses ,  but  in  many  cases 
only  the  problems  will  be  identified  leaving  the  necessity  of  further 
research  to  eliminate  the  hazard. 

Discussion  and  Conclusions 

Discussion 

Tables  10  and  11  summarized  the  results  of  the  accident  investigations 
in  terms  of  the  system  characteristics  which  were  principally  involved  in 
each  incident.    Referring  to  these  tables  again,  it  is  apparent  that 
certain  of  the  characteristics  are  more  common  in  occurrence  than  others. 
While  this  sample  is  too  small  to  be  conclusive;  individual  work  practices 
clearly  dominates  while  training  and  tool  design  and  function  show  only 
slightly  less  involvement  and  all  three  are  highly  related.  Nfotor 
skill,  because  of  the  One  Hole  Test  score  indications,  is  also  a  very 
inportant  characteristic. 

On  the  basis  of  the  information  available  from  this  study  it  is 
suggested  that  the  following  be  slated  for  primary  emphasis  in  the  initial 
stages  of  any  research  which  will  follow: 


Other  system  characteristics  should  be  added  to  this  list  as  progress  is 
made  and  additional  funds  and  opportunities  become  available. 


1. 

2. 
3. 
4. 


Individual  Work  Practices 

Motor  Skills 

Training 

Tool  Design  and  Function 
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This  relatively  small  priority  list  matches  the  top  two  priorities 
arrived  at  by  Ayoub,  Purswell  and  Hoag  (1975)  and  includes  training  which 
developed  as  the  fifth  priority  in  that  study.    Of  course,  the  sample  here 
is  too  small  to  be  conclusive  but  this  does  indicate  that  a  degree  of 
confidence  may  be  placed  in  the  expert  opinion  method  of  priority 
assignment  developed  by  Ayoub  et.  al.  (1975). 

Conclus  ion 


Handtools  are  a  serious  threat  to  the  worker  who  uses  them  when  a 
characteristic  of  himself,  the  tool,  the  task,  work  practices  and/ or  their 
interactions  interferes  with  a  safe  application.    The  data  available  support 
this  statement  since  it  shows  that  handtools  account  for  between  five  and 
10  percent  of  all  work  injuries.    However,  little  can  be  done  to  improve 
the  safety  of  handtool  use  until  more  is  known  about  what  causes  the 
accidents  which  occur.    A  typical  accident  data  collection  form  assigns 
causes  of  accidents  to  categories .    One  form  in  particular  uses  the 
categories  listed  below. 


If  carefully  con^leted,  these  categories  might  reveal  areas  where  emphasis 
is  needed  to  reduce  injuries  but  the  action  taken  could  not  be  directed  to 
the  cause  because  no  specific  cause  is  defined.    There  is,  then,  a  void  between 
what  causes  accidents  and  what  can  be  done  to  prevent  them.    To  fill  this 
void  a  wide  range  of  information  is  required;  identifying  the  principal 
causes  of  handtool  accidents. 

By  incorporating  the  system  characteristics  of  Purswell,  Ayoub,  and 
Hoag  into  a  data  collection  form  it  was  shown  that  actual  causes  of  accidents 
can  be  identified.    Once  the  syston  characteristics  identified  most 
frequently  as  principal  causes  are  located,  specific  research  can  be  needed 
or  preventive  measures  can  be  started  in  these  areas .    The  research  will 
ultimately  reveal  the  steps  necessary  to  devise  effective  control  measures 
for  handtool  injuries. 


1. 
2. 
3. 
4. 
5. 


Unsafe  Condition 
Unsafe  Act 

IMsafe  Personal  Factor 
Material  Failure 

No  Fault  of  Personnel  or  Material 


93 


BIBLIOGRAPHY 


1.  Ayoub,  M.M. ,  and  McDaniel,  Joe  W.    "Criteria  and  Standards  for  Non- 

Electric  Hand  Tools;  A  Literature  Review  and  Recommendations," 
report  submitted  to  IMEW/PHS,  National  Institution  for 
Occupational  Safety  and  Health,  1973. 

2.  Ayoub,  M.M. ,  Purswell,  J.L.,  and  Hoag,  Laveme    "Research  Requirements 

on  Hand  Tools,"  report  submitted  to  DHEW/PHS,  National 
Institute  for  Occupational  Safety  and  Health,  1975. 

3.  Chevron  Shipping  Company,    "Choose  and  Use  Handtools  Carefully," 

Safety  Review,  November  1970,  27  (11),  15. 

4.  National  Safety  Council  Accident  Facts.    1972  Edition,  Chicago,  Illinois 

5.  National  Safety  Council  Accident  Facts.    1973  Edition,  Chicago,  Illinois 

6.  National  Safety  Council  Accident  Facts.    1974  Edition,  Chicago,  Illinois 

7.  New  York  State  Department  of  Labor.    "Characteristics  and  Costs  of 

Work  Injuries  in  New  York  State,  1966-1970,"  1972,  Vol.  1-10, 
Special  Bulletin,  p.  243. 

8.  Salvendy,  Gavriel    "Selection  of  Industrial  Operators,  The  One  Hole 

Test,"  Int.  Journal  Production  Research,  1975,  13  (3),  303-321. 

9.  Scott,  W.G.,  and  Mitchell,  T.R.    Organization  Theory  a  Structural  and 

Behavioral  Analysis.    Ontario :    Irwin  Dorsey  Limited,  1972. 

10.  State  of  California,  Department  of  Industrial  Relations,  Division  of 

Labor  Statistics  and  Research.    California  Work  Injuries- -1970, 
San  Francisco,  March  1970,  p.  36-37. 

11.  State  of  California,  California  Work  Injuries,  1967-1972,  Division  of 

Labor  Statistics  and  Research. 

12.  The  Industrial  Commission  of  Ohio,  Division  of  Safety  and  Hygiene, 

Hand  Tools,  No.  4,  1967,  p.  1-19. 

13.  Welford,  A.T.    Aging  and  Human  Skill,  A  report  centered  on  work  by  the 

Nuffield  Unit  for  research  in  problems  of  aging,  Oxford 
University  Press,  1958. 


94 


ATTACHMENT  1 
LIFE  STRESS  PROFILE 
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Attachment  1  -  Life  Stress  Profile 

(all  responses  are  confidential) 

(1)  Do  you  generally  eat  at  the  same  times  each  day?   

Did  you  do  so  on  the  day  of  the  accident?   

(2)  Were  you  planning  special  recreational  activity  for  after  work 
the  day  of  the  accident?   

(3)  Were  you  concerned  about  a  personal  problem  on  the  day  of  the 

accident?   

(4)  Had  you  been  off  work  for  a  full  day  or  more  prior  to  the  day 

of  the  accident,  (including  weekends)?   

(5)  On  the  day  of  the  accident  were  you  concerned  about  an  important 

financial  or  business  arrangement? 

(e.g.,  buying  land,  a  car,  insurance,  etc.)   

(6)  Do  you  occasionally  bet  on  football  or  play  poker?   

(7)  On  the  average,  how  many  alcoholic  drinks  do  you  drink  in  a 

week?   a  day?    (one  can  or  glass  equals  one  drink) 

(8)  On  the  day  of  the  accident,  did  you  have  a  disagreement  with  your 

supervisor  or  a  fellow  worker?   

(9)  Was  there  a  change  in  your  working  conditions  within  three  days 

prior  to  the  accident?   
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How  many  work  related  accidents  have  you  had  in  the  last  12  months 
including  lost  time,  first  aid  and  unreported  accidents?   

Prior  to  the  accident  were  you  engaged  in  any  unusual  off- the -job 
activity?    (e.g.,  overhauling  a  car,  building  a  swimming  pool, 
etc.)   
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ATTACHMENT  2 
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lo 

Sex 

Training  for  this  tool? 

11 

Grade 

i 
1 

Description  of  injury 

Injury  tyoe 

Time  of  iniury 

Body  part 

L3 

Minutes  since  break 

Severity 

14 

Minutes  to  break 

5 

Work  tim6  missed  (minutes) 

L5 

Hand  used 

7 

Health                   ;  Is  it  related  to  acc? 

Draw  stick  figures  showing  position 
at  the  time  of  the  accident  and 
describe  the  position  of  the  hands 

! — 

8    Below,   trace  the  hand  used 
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1 
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I 
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i  _16  [  was  anthrcpoo'.ecrv  a  cgusative  factor? 
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Tool  used 

iS 

Function 

19 

Power  class 

20 

List  any  protective  equipment  used 

21 

Were  any  holders,  retainers,  pouches. 

etc.  ,  used? 

22 

If  21  is  yes,  describe: 

1 

i 
! 

1 

Size,  shape  and  balance 

24 

Texture: 

Causative? 

25 

Material: 

\^  Cl  U  J  d    l_             V     W  > 

26 

Weight : 

Causative? 

27 

Workplace: 

Causative? 

E 

28 

i 

1 

l- 

V'orkpiece : 

1 
t 
1 

Causative? 

-4 

29 

!  

30 

Envi  r o  nmen  t : 

Causative? 

i 

j Task  Raquircnents : 
? 

Causative? 

1  

31 

! 

i 

^ — 

i 

j Individual  work  practices: 
1 

Causative? 

!32 

I 

CoTipaiiy  work  practices: 

Causative? 

- 

33 

Government  work  practices: 

Causative? 

3^: 

1 

Possible  causes: 

Causative? 
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SIMJIATION  IN  ACCIDENT  RESEARCH 


Stanley  Rubinsky,  Ph.D.,  P.E. 
University  of  Rhode  Island 

STANLEY  RUBINSKY  is  professor  of  industrial 
engineering  at  the  University  of  Rhode  Island. 
His  research  includes  small  power  tool  accident 
research,  study  of  hazards  aboard  commercial  fishing 
vessels,  and  the  design  of  a  state  p].an  for 
implementation  of  OSHA  in  Rhode  Island. 

Rubinsky 's  paper  describes  the  use  of  two 
types  of  simulators:    (1)  the  "process  simulator" 
which  is  designed  to  perform  like  a  normal  machine 
except  that  "an  accident  involving  the  simulator 
cannot  result  in  injury...";  and  (2)  the  "accident 
simulator"  with  which  noninjurious  "accidents"  can 
be  caused  to  occur.    The  major  difference  between 
these  two  types  of  simulators  appears  to  lie  in 
the  purposes  of  the  experimental  situations  in  which 
they  are  employed.    The  process  simulator  was  used  in 
studies  to  determine  the  variables  affecting  the 
occurrence  of  accidents.    The  accident  simulator  was 
employed  to  subject  participants  to  "accidents"  in 
a  training  situation. 


A  classification  of  accidents  by  cause  should  be  of  help  in  developing 
preventative  measures .    Such  a  classification  scheme  could  include  accidents 
due  to  design  deficiencies,  accidents  caused  by  negligent  misuse,  and  those 
caused  by  misuse  or  improper  use  because  of  lack  of  knowledge.  Obviously, 
accidents  caused  by  design  deficiencies  would  be  eliminated  by  improving 
the  design.    An  example  of  this  is  a  household  electric  meat  grinder  in 
which  an  operator  lost  the  tips  of  two  fingers  in  the  feed  screw  section. 
Increasing  the  length  of  the  entrance  tube  so  that  the  fingers  would  no 
longer  reach  the  feed  screw  would  eliminate  the  possibility  of  an  accident 
from  this  source.    Accidents  caused  by  deliberate  negligence  or  misuse 
are  much  more  difficult  to  cope  with.    An  investigation  of  the  reasons 
for  the  negligence  would  seem  to  be  in  order.    Was  the  negligence  the  result 
of  fatique,  drugs,  mental  stress,  or  a  lack  of  appreciation  for  the  possible 
injury?    Knowledge  of  these  factors  could  suggest  some  program  of  remedial 
action.    If  the  accident  were  the  result  of  the  lack  of  knowledge  or  training, 
the  remedial  steps  are  immediately  apparent.    But,  what  is  the  most  effective 
educational  or  training  method?    It  was  the  attempt  to  answer  some  of  these 
questions  which  led  to  the  investigation  of  simulation  as  a  possible 
research  tool. 

Incidentally,  I  am  referring  only  to  accidents  and  not  to  injuries 
because,  to  my  mind,  they  are  essentially  equivalent.    It  is  usually  pure 
chance  which  separates  the  accident  from  which  no  damage  occurs  from  that 
in  which  substantial  injury  or  even  death  could  result. 
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Our  investigation  into  the  causes  o£  accidents  led  to  the  development 
o£  two  types  of  sijnulators .    The  first  type,  which  we  call  the  process 
simulator,  is  designed  to  perform  like  a  regular  process,  machine,  or  hand 
tool  except  that  an  accident  involving  the  simulator  cannot  result  in  injury 
to  the  operator.    For  instance,  the  meat  grinder  could  have  been  fitted 
with  a  soft  plastic  or  rubber  feed  screw  and  a  soft  substance  such 
as  gelatine  cubes  substituted  for  the  meat.    Thus  all  possible  methods 
of  misusing  the  grinder  could  be  investigated  and  fingers  caught  in  the 
feed  screw  as  a  result  of  this  misuse  would  not  be  injured.    It  was  on  this 
basis  that  a  punch  press  process  simulator  was  designed  and  tested. 

The  Process  Simulator 

A  Powermaster  Benchmaster  No.  142E  2-ton  power  driven  bench  press  was 
purchased  and  modified  for  use  as  a  simulator.    This  press  could  be 
operated  in  three  ways:    by  foot  pedal,  by  a  hand  lever,  or  by 
a  pair  of  interlocked  handlevers ,  thus  providing  the  option  of  operation  in 
any  one  of  three  modes,  varying  from  no  protection  of  the  operator's  hand 
to  protection  of  one  or  both  hands . 

A  typical  accident  with  this  machine  occurs  during  a  press  cycle  when  the 
operator  fails  to  remove  his  hand  from  between  the  closing  dies.    The  result 
can  vary  from  laceration  of  a  finger  tip  to  the  complete  loss  of  several 
fingers.    In  order  to  eliminate  the  possibility  of  real  injury  to  the  operator, 
a  modification  of  the  blanking  or  stamping  die  normally  mounted  in  the 
machine  was  made.    The  lower,  or  female,  half  of  the  die  pair  was  made  in  the 
usual  form,  except  that  it  was  fabricated  of  wood  and  painted  to  resemble 
metal.    The  male,  or  upper  half  of  the  pair,  however,  was  made  of  Porlon,  a 
plastic  material  containing  micropores  filled  with  ink.    The  modified  die 
is,  in  effect,  a  self- inking  rubber  stamp.    This  die  substitutes  an  inked 
inipression  from  a  soft  die  for  the  stamped  impression  made  by  a  steel  die. 
The  Porlon  "die"  was  fastened  to  a  spring -mounted  dieholder  so  that  when 
an  operator's  finger  was  caught  between  the  pair  of  dies  no  injury,  pain, 
or  discomfort  would  result.    The  operator  did  suffer  an  inked  mark  on  the 
"injured"  finger.    Heavy  card  stock  was  substituted  for  the  metal  blanks 
normally  used  as  wor]q)ieces. 

The  press  was  also  equipped  with  a  counter  to  register  the  number  of 
strokes  of  the  press ,  and  with  a  second  counter  actuated  by  a  microswitch 
mounted  on  the  spring  dieholder  to  accumulate  a  count  of  "accidents."  A 
light  and  a  buzzer  were  connected  to  the  circuit  that  was  counting  the 
accidents.    Suitable  switches  made  it  possible  for  the  buzzer  to  be 
disconnected.    The  counting  circuit  thus  could  be  used  selectively  to 
signal  the  operator  when  an  error  or  accident  occurred. 

The  simulator  was  tested,  first  to  determine  whether  accidents 
could  be  forced  to  a  reasonably  high  and  countable  frequency  and,  second, 
to  ascertain  whether  those  variables  which  were  thought  to  influence 
real  accidents  would  similarly  influence  the  frequency  of  simulated  accidents. 
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The  punch  press  was  set  up  to  stamp  cards  using  the  foot  pedal  control 
mode.    Thus,  since  there  were  no  guards  on  the  press  either  or  both  hands 
could  be  caught  between  the  dies .    Twenty  college  students ,  10  male  and  10 
female,  volunteered  to  serve  as  subjects.    The  males  were  divided  randomly 
into  two  groups ,  as  were  the  females .    One  group  of  males  and  one  of  females 
were  paid  a  flat  hourly  rate.    The  second  set  of  groups  were  paid  the  same 
hourly  rate  as  a  minimum,  but  could  earn  more  money  by  increasing  their 
output.    Both  groups  were  instructed  in  the  designated  method  of  operation 
and  each  subject  was  allowed  an  eight-minute  practice  period  and  a  two- 
minute  rest  before  the  production  run.    The  subjects  were  told  that  the 
experiment  was  designed  to  study  the  effect  of  workplace  layout  and  design 
on  production  output. 

The  test  results  revealed  that  six  of  the  twenty  subjects  were  accident 
free  and  that  two  of  the  subjects  incurred  six  accidents  each  during  a  one- 
hour  run.    An  analysis  of  the  results  led  to  the  conclusion  that  accidents 
could  be  made  to  occur  with  sufficient  frequency  to  allow  a  meaningful  study 
in  a  reasonable  length  of  time  and,  further,  that  the  frequency  of  accidents 
could  be  manipulated  by  changing  experimental  conditions . 

Following  this  work,  the  simulator  was  refined  by  replacing  the 
lower  die  block  by  an  aluminum  block  in  which  were  embedded  four  sensors , 
one  in  each  corner,  which  enabled  the  experimenter  to  determine  that  a 
workpiece  was  in  place  at  each  stroke  of  the  press  and  also  that  the 
workpiece  was  properly  positioned  so  as  to  produce  a  good  part.    Further,  a 
delay  circuit  was  introduced  so  that  an  accident  shut  off  power  to  the  press 
for  a  predetermined  time  in  order  to  introduce  a  money  penalty.    In  addition, 
the  press  has  been  equipped  with  a  vigilance  task.    At  the  appearance  of  a  red 
light,  the  operator  is  required  to  push  a  button  to  extinguish  the  light 
before  operating  the  next  press  cycle.    Failure  to  activate  the  button  results 
in  a  press  shut  down  of  a  shorter  duration  than  that  of  the  accident  shut  down. 
Also,  all  the  counters  and  control  equipment  are  now  located  at  a  remote 
location  so  that  the  observer  is  not  in  the  same  room  as  the  subject  and 
can,  therefore,  have  no  effect  on  the  subject's  performance.  Additional 
research  using  this  simulator  is  now  going  on. 

The  Accident  Simulator 

The  second  type  of  simulator  is  that  which  simulates  the  accident,  again, 
with  no  danger  to  the  operator.    In  the  design  of  this  device,  several 
criteria  were  set  up.    First,  the  "injury"  resulting  from  the  accident  should 
be  aversive  to  the  subject;  second,  the  "injury"  must  be  directly  related  to 
the  accident;  third,' the  unsafe  act  causing  the  accident  should  not  be 
trivial;  fourth,  the  total  environment  should  be  realistic;  and  fifth,  the 
injury  must  be  certifiable  by  an  objective  and  competent  jury  as  being 
physically  and  psychologically  harmless  to  the  subject. 

A  bench  grinder  was  modified  and  equipped  with  water  jets  that  could 
be  used  to  spray  the  operator  (an  aversive  stimulus)  in  such  a  way  as  to 
simulate  an  exploding  grinding  wheel  or  a  flying  spark.    Originally,  the  jet 
was  activated  by  a  hidden  remote  switch  controlled  by  the  experimenter. 
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Since  the  unsafe  act  consisted  o£  standing  in  front  of  the  grinder  during 
the  start  up  period,  the  manual  switch  was  replaced  by  a  hidden  mat  switch 
located  in  front  of  the  grinder.    If  the  operator  started  the  machine  while 
standing  on  the  mat,  the  spray  was  activated.    If  the  operator  stepped  in 
front  of  the  grinder  after  it  reached  operating  speed,  the  spray  was  not 
activated. 

The  accident  simulator  was  used  to  investigate  its  effectiveness  as 
an  aid  in  safety  training  and  education.    Basically,  two  questions  were 
explored.    First,  did  the  demonstration  of  an  accident  aid  in  the  training 
for  the  safe  use  of  a  machine  and,  second,  was  there  any  additional  value  in 
having  the  trainee  actually  experience  the  simulated  accident? 

Briefly,  thirty-two  subjects  were  randomly  divided  into  four  groups. 
Each  group  received  written  instructions  and  a  demonstration  of  the  correct 
method  of  operating  the  grinder.    In  addition,  one  group  received  a 
demonstration  of  the  simulated  accident,  another  group  was  subjected  to  the 
accident  while  operating  the  grinder,  and  the  last  group  received  both  a 
demonstration  and  an  experience  of  the  accident.    In  all  cases,  the  simulated 
accident  was  used  only  during  the  orientation  session  and  never  used  during 
the  test  sessions.    All  subjects  were  told  that  the  object  of  the  experiment 
was  to  test  their  ability  to  separate  10  samples  of  steel  by  observing  the 
pattern  of  grinding  sparks.    Each  subject,  therefore,  started  the  machine 
ten  times.    An  analysis  of  the  results  of  this  first  experiment  showed  that 
all  three  groups  exposed  to  the  simulated  accident  either  by  demonstration, 
by  experience,  or  both,  had  statistically  significantly  fewer  accidents 
than  the  members  of  the  one  group  that  had  no  experience  with  the  simulated 
accident.    There  were  no  significant  differences  among  the  other  groups. 

A  second  test  involving  72  college  students  was  arranged  to  duplicate 
the  first  experiment  except  that  each  subject  was  tested  three  times  with 
a  one  week  interval  between  tests  one  and  two,  followed  by  a  three  week 
interval  between  tests  two  and  three.    The  result  of  this  experiment  showed 
that  while  the  mean  number  of  accidents  of  all  groups  seoned  to  be  reduced 
somewhat  with  the  passage  of  time,  the  differences  were  not  significant  except 
that  the  group  for  which  the  accident  was  both  demonstrated  and  experienced 
had  significantly  fewer  accidents  than  did  the  other  groups . 

A  third  test  involving  120  volunteer  students  was  conducted.    In  this 
test  the  control  group  of  30  students  received  written  instructions  and  a 
demonstration  of  the  correct  procedures ,  as  had  been  done  in  the  two  previous 
experiments.    The  remaining  three  groups  were  each  shown  and  subjected  to 
training  accidents,  one  group  to  two,  a  second  to  five,  and  the  remaining 
group  to  ten  accidents.    In  addition,  each  group  was  subdivided  and  one 
subgroup  was  given  a  consecutive  schedule  of  accident  exposure  and  the 
other  an  intermittent  randomly  selected  schedule  of  exposures.  Finally, 
the  groups  were  all  tested  for  retention  of  training  at  one  month,  three 
month,  and  six  month  intervals. 

By  the  end  of  six  months,  80  subjects  remained  so  the  groups  were 
equalized  by  randomly  eliminating  subjects  from  the  larger  groups.  The 
analysis  of  the  results  surprised  us.    Briefly,  the  difference  of  all 
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groups  from  the  control  group  exceeded  expectations ,  but  there  was  no 
significant  difference  among  any  of  the  other  groups  nor  was  there  a  difference 
between  subgroups  attributable  to  differing  schedules  of  accident  exposure. 
Finally,  it  was  clearly  shown  that  the  improvement  in  the  accident  rate 
which  was  attributed  to  use  of  the  simulator  was  retained  for  at  least  six 
months  after  training. 

Thus,  we  believe  that  accident  simulation  offers  a  powerful  means  for 
training  in  safety  procedures.    However,  this  is  not  necessarily  an  easy  under- 
taking since  the  simulation  should  meet  the  criteria  already  stated.  One 
may  conceive,  for  instance,  of  arranging  for  accidents  in  a  driving  simulator 
but  it  is  doubtful  that  such  accidents  would  have  much  effect  on  subsequent 
driving  habits  unless  and  until  a  suitable  aversive  result  of  the  accident 
can  be  devised. 

Process  simulation  requires  only  that  it  be  realistic  in  its  operation 
and  conpletely  harmless  to  the  operator.    The  present  punch  press  simulator 
is  now  being  used  to  study  effects  of  secondary  tasks.    It  may  be  used  to 
study  machine  guarding;  the  effect  of  fatigue,  drugs,  visual  and  aural  dis- 
traction, noise;  and  other  such  factors  and  their  effect  on  a  machine  operator. 

To  sum  i:^,  we  believe  that  both  types  of  simulators  will  prove  to  be 
valuable  learning  and  research  tools  in  our  efforts  to  gain  a  better  insight 
into  the  causes  and  prevention  of  accidents. 


109 


1 


\ 


i 

I 

I 
I 

1 

I 
I 

I 

I 

1 

I 

I 

I 

i 

i 

I 


Participants 


Jonathan  Adler 

National  Bureau  of  Standards 

Washington,  D.C. 

*  M.  M.  Ayoub 

Texas  Tech  University 
Lubbock,  Texas 

*  Ludwig  Benner,  Jr. 

National  Transportation  Safety 

Board 
Washington,  D.C. 

**  Philippe  V.  Garden 

National  Institutes  of  Health 
Bethesda,  Maryland 

Robert  Cunitz 

National  Bureau  of  Standards 
Washington,  D.C. 

*  Robert  Eicher 

Energy  Research  and  Development 

Adminis trat  ion 
Washington,  D.C. 

John  V.  Fechter 

National  Bureau  of  Standards 

Washington,  D.C. 

Charles  Fried 

National  Bureau  of  Standards 
Washington,  D.C. 

*  Willie  Hammer 

Hughes  Aircraft  Company 
Culver  City,  California 

Clarke  E.  Jones 

National  Bureau  of  Standards 

Washington,  D.C. 

Joel  Kramer 

National  Bureau  of  Standards 
Washington,  D.C. 

*  Invited  Presentation 
**  Dinner  Speaker 


Pat  Meguire 

National  Bureau  of  Standards 
Washington,  D.C. 

J.  J.  Persensky 

National  Bureau  of  Standards 

Washington,  D.C. 

*  George  A.  Peters 

Los  Angeles ,  California 

Val  Pezoldt 

National  Bureau  of  Standards 
Washington,  D.C. 

R.  David  Pittle 

Consumer  Product  Safety  Commission 
Washington,  D.C. 

Louis  G.  Porter 

National  Bureau  of  Standards 

Washington,  D.C. 

Jerry  Purswell 
University  of  Oklahoma 
Norman,  Oklahoma 

Jerry  Ramsey 

Consumer  Product  Safety  Commission 
Washington,  D.C. 

Stuart  Robinson 

National  Bureau  of  Standards 

Washington,  D.C. 

*  Stanley  Rubinsky 
University  of  Rhode  Island 
Kingston,  Rhode  Island 

*  Rose  E.  Steidl 
Cornell  University 
Ithaca,  New  York 

Harold  P.  Van  Cott 

National  Bureau  of  Standards 

Washington,  D.C. 

*  Julian  A.  Waller 
IMiversity  of  Vermont 
Burlington,  Vermont 


i-  U.  S.  GOVERNMENT  PRINTING  OFFICE  :  1977--240-848/214 


111 


NBS-114A  (REV.  7-73) 


U.S.  DEPT.  OF  COMM. 

BIBLIOGRAPHIC  DATA 
SHEET 

1.  PUBLICATION  OR  REPORT  NO. 

NBS  SP-482 

2.  Gov't  Accession 
No. 

3.  Recipient's  Accession  No. 

4.  TITLE  AND  SUBTITLE  , 

Rare  Event/Accident  Research  Methodology 

Proceedings  of  a  Workshop  held  at  the  National  Bureau  of 
Standards,  Gaithersburg,  Maryland,  May  26-28,  1976 

5.  Publication  Date 

Julv  1977 

6.  Performing  Organization  Code 

7.  AUTHOR(S) 

V-  J-  Pezoldt-  Editor 

8.  Performing  Organ.  Report  No. 

9.  PERFORMING  ORGANIZATION  NAME  AND  ADDRESS 

NATIONAL  BUREAU  OF  STANDARDS 
DEPARTMENT  OF  COMMERCE 
WASHINGTON,  D.C.  20234 

10.  Project/Task/Work  Unit  No. 

441-0126 

11.  Contract/Grant  No. 

12.  Sponsoring  Organization  Name  and  Complete  Address  (Street,  City,  State,  ZIP) 

Same  as  item  9 

13.  Type  of  Report  &  Period 
Covered 

Final 

14.  Sponsoring  Agency  Code 

15.  SUPPLEMENTARY  NOTES 


Libraiy  of  Congress  Catalog  Card  Number:  77-608110 

16.  ABSTRACT  (A  200-word  or  less  {actual  summary  ot  most  sigpilicant  information.   II  document  includes  a  signilicant 
bibliography  or  literature  survey,  mentiai  it  here.) 

This  volume  contains  the  formal  papers  presented  at  a  Workshop  on  Rare 
Event/Accident  Research  Methodology  sponsored  by  the  Human  Factors  Section  of 
the  Center  for  Consumer  Product  Technology,  National  Bureau  of  Standards 
held  at  NBS  May  26-28,  1976.    The  topics  addressed  at  the  workshop  and 
reflected  in  the  papers  in  this  volume  include  system  safety  engineering, 
hypothesis  generation  in  accident  research,  epidemiological  approaches  to 
injuiy  research,  observational  techniques  for  studying  complex  tasks,  accident 
sinailation,  and  methodological  considerations  being  forced  by  the  law. 


17.  KEY  WORDS  (six  to  twelve  entries;  alphabetical  order;  capitalize  only  tfie  lirst  letter  of  the  first  key  word  unless  a  proper 
name;  separated  by  semicolons) 

Accident  research;  human  factors;  methodology;  rare  events;  safety;  system  safety 


18.  AVAILABILITY  [X]  Unlimited 

I     !  For  Official  Distrib  ution.   Do  Not  Release  to  NTIS 

I  yS  Order  From  Sup.  of  Doc,  U.S.  Government  Printing  Office 
Washington,  D.C.  20402,  SD  Cat.  No.  CI?  ,ir\.  I^AO 

I     I  Order  From  National  Technical  Information  Service  (NTIS) 
Springfield,  Virginia  22151 


19.  SECURITY  CLASS 
(THIS  REPORT) 


UNCLASSIFIED 


20.  SECURITY  CLASS 
(THIS  PAGE) 

UNCLASSIFIED 


21.  NO.  OF  PAGES 


112 


22.  Price 


U  SCp(«IM- D  C~29042- P  7  4 


NBS  TECHNICAL  PUBLICATIONS 


PERIODICALS 

JOURNAL  OF  RESEARCH  reports  National  Bureau 
of  Standards  research  and  development  in  physics, 
mathematics,  and  chemistry.  It  is  published  in  two 
sections,  available  separately: 

•  Physics  and  Chemistry  (Section  A) 

Papers  of  interest  primarily  to  scier*  orking  in 

these  fields.  This  section  covers  a  br  .ige  of  physi- 
cal and  chemical  research,  wit>  ^^'^  ^r  emphasis  on 
standards  of  physical  measu'-  ,  fundamental  con- 
stants, and  properties  of  m^  ^*  '.dsued  six  times  a  year. 
Annual  subscription:  D'  ^'fi^^,  $17.00;  Foreign,  $21.25. 

•  Mathematical  Sci'  ^<p>**^ Section  B) 

Studies  and  com'-'  ^*  .is  designed  mainly  for  the  math- 
ematician and  .Q<^*<itical  physicist.  Topics  in  mathemat- 
ical statis*^'^^(5j^\ieory  of  experiment  design,  numerical 
analys)'"  ^  ^retical  physics  and  chemistry,  logical  de- 
sign ^  programming  of  computers  and  computer  sys- 
t*-  gX^jHort  numerical  tables.  Issued  quarterly.  Annual 
st^  jcription:  Domestic,  $9.00;  Foreign,  $11.25. 

DIMENSIONS/NBS  (formerly  Technical  News  Bulle- 
tin)— This  monthly  magazine  is  published  to  inform 
scientists,  engineers,  businessmen,  industry,  teachers, 
students,  and  consumers  of  the  latest  advances  in 
science  and  technology,  with  primary  emphasis  on  the 
work  at  NBS.  The  magazine  highlights  and  reviews 
such  issues  as  energy  research,  fire  protection,  building 
technology,  metric  conversion,  pollution  abatement, 
health  and  safety,  and  consumer  product  performance. 
In  addition,  it  reports  the  results  of  Bureau  programs 
in  measurement  standards  and  techniques,  properties  of 
matter  and  materials,  engineering  standards  and  serv- 
ices, instrumentation,  and  automatic  data  processing. 

Annual  subscription:  Domestic, $12.50;  Foreign, $15.65. 

NONPERIODICALS 

Monographs — Major  contributions  to  the  technical  liter- 
ature on  various  subjects  related  to  the  Bureau's  scien- 
tific and  technical  activities. 

Handbooks — Recommended  codes  of  engineering  and 
industrial  practice  (including  safety  codes)  developed 
in  cooperation  with  interested  industries,  professional 
organizations,  and  regulatory  bodies. 
Special  Publications — Include  proceedings  of  conferences 
sponsored  by  NBS,  NBS  annual  reports,  and  other 
special  publications  appropriate  to  this  grouping  such 
as  wall  charts,  pocket  cards,  and  bibliographies. 

Applied  Mathematics  Series — Mathematical  tables,  man- 
uals, and  studies  of  special  interest  to  physicists,  engi- 
neers, chemists,  biologists,  mathematicians,  com- 
puter programmers,  and  others  engaged  in  scientific 
and  technical  work. 

National  Standard  Reference  Data  Series — Provides 
quantitative  data  on  the  physical  and  chemical  proper- 
ties of  materials,  compiled  from  the  world's  literature 
and  critically  evaluated.  Developed  under  a  world-wide 
program  coordinated  by  NBS.  Program  under  authority 
of  National  Standard  Data  Act  (Public  Law  90-396). 


NOTE:  At  present  the  principal  publication  outlet  for 
these  data  is  the  Journal  of  Physical  and  Chemical 
Reference  Data  (JPCRD)  published  quarterly  for  NBS 
by  the  American  Chemical  Society  (ACS)  and  the  Amer- 
ican Institute  of  Physics  (AIP).  Subscriptions,  reprints, 
and  supplements  available  from  ACS,  1155  Sixteenth 
St.  N.W.,  Wash.  D.  C.  20056. 

Building  Science  Series — Disseminates  technical  infor- 
mation developed  at  the  Bureau  on  building  materials, 
components,  systems,  and  whole  structures.  The  series 
presents  research  results,  test  methods,  and  perform- 
ance criteria  related  to  the  structural  and  environmental 
functions  and  the  durability  and  safety  characteristics 
of  building  elements  and  systems. 

Technical  Notes — Studies  or  reports  which  are  complete 
in  themselves  but  restrictive  in  their  treatment  of  a 
subject.  Analogous  to  monographs  but  not  so  compre- 
hensive in  scope  or  definitive  in  treatment  of  the  sub- 
ject area.  Often  serve  as  a  vehicle  for  final  reports  of 
work  performed  at  NBS  under  the  sponsorship  of  other 
government  agencies. 

Voluntary  Product  Standards — Developed  under  proce- 
dures published  by  the  Department  of  Commerce  in  Part 
10,  Title  15,  of  the  Code  of  Federal  Regulations.  The 
purpose  of  the  standards  is  to  establish  nationally  rec- 
ognized requirements  for  products,  and  to  provide  all 
concerned  interests  with  a  basis  for  common  under- 
standing of  the  characteristics  of  the  products.  NBS 
administers  this  program  as  a  supplement  to  the  activi- 
ties of  the  private  sector  standardizing  organizations. 

Consumer  Information  Series — Practical  information, 
based  on  NBS  research  and  experience,  covering  areas 
of  interest  to  the  consumer.  Easily  understandable  lang- 
uage and  illustrations  provide  useful  background  knowl- 
edge for  shopping  in  today's  technological  marketplace. 

Order  above  NBS  publications  from:  Superintendent 
of  Documents,  Government  Printing  Office,  Washington, 
D.C.  20402. 

Order  following  NBS  publications— NBSIR's  and  FIPS 
from  the  National  Technical  Information  Services, 
Springfield,  Va.  22161. 

Federal  Information  Processing  Standards  Publications 
(FIPS  PUBS) — Publications  in  this  series  collectively 
constitute  the  Federal  Information  Processing  Stand- 
ards Register.  Register  serves  as  the  official  source  of 
information  in  the  Federal  Government  regarding  stand- 
ards issued  by  NBS  pursuant  to  the  Federal  Property 
and  Administrative  Services  Act  of  1949  as  amended. 
Public  Law  89-306  (79  Stat.  1127),  and  as  implemented 
by  Executive  Order  11717  (38  FR  12315,  dated  May  11, 
1973)  and  Part  6  of  Title  15  CFR  (Code  of  Federal 
Regulations). 

NBS  Interagency  Reports  (NBSIR) — A  special  series  of 
interim  or  final  reports  on  work  performed  by  NBS  for 
outside  sponsors  (both  government  and  non-govern- 
ment). In  general,  initial  distribution  is  handled  by  the 
sponsor;  public  distribution  is  by  the  National  Techni- 
cal Information  Services  (Springfield,  Va.  22161)  in 
paper  copy  or  microfiche  form. 


BIBLIOGRAPHIC  SUBSCRIPTION  SERVICES 


The  following  current-awareness  and  literature-survey 
bibliographies  are  issued  periodically  by  the  Bureau: 
Cryogenic  Data  Center  Current  Awareness  Service.  A 

literature  survey  issued  biweekly.  Annual  subscrip- 
tion: Domestic,  $25.00  ;  Foreign,  830.00'. 
Liquified  Natural  Gas.  A  literature  survey  issued  quar- 
terly. Annual  subscription:  $20.00. 


Superconducting  Devices  and  Materials.  A  literature 
survey  issued  quarterly.  Annual  subscription:  $30.00  . 
Send  subscription  orders  and  remittances  for  the  pre- 
ceding bibliographic  services  to  National  Bureau  of 
Standards,  Cryogenic  Data  Center  (275.02)  Boulder, 
Colorado  80302. 
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